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BY  HIS  EXCELLENCY 

ARGEO  PAUL  CELLUCCI 
GOVERNOR 

EXECUTIVE  ORDER  NO.  408 

MEETING  THE  YEAR  2000  CHALLENGE 


WHEREAS,  the  Commonwealth  of  Massachusetts  relies  extensively  on  computer 
and  communications  technologies  to  provide  a  broad  range  01  services  necessary  for  the 
health,  welfare,  and  safety  of  its  citizens;  and 


WHEREAS,  many  computer  and  communications  systems,  including  hardware, 
software,  and  firmware,  were  designed  in  such  a  way  that  they  cannot  accurately  process 
date  information  for  dates  after  December  31,  1999;  and 

WHEREAS,  Year  2000  failures  in  the  Commonwealth's  mission  critical  and 
essential  computer  and  communications  systems  could  have  serious  consequences  for  the 
health,  welfare,  and  safety  of  the  citizens  of  the  Commonwealth;  and 

WHEREAS,  the  Commonwealth  has  already  devoted  substantial  human,  financial, 
and  technical  resources  over  the  past  several  years  to  address  the  Year  2000  problem  and 
has  made  significant  progress  in  this  regard;  and 

WHEREAS,  the  Commonwealth  must  be  vigilant  to  minimize  potential  Year  2000 
disruptions  in  its  computer  and  communications  systems; 


NOW,  THEREFORE,  I,  Argeo  Paul  Cellucci,  Governor  of  the  Commonwealth  of 
Massachusetts,  by  virtue  of  the  authority  vested  in  me  as  Supreme  Executive  Magistrate, 
do  hereby  order  as  follows: 

Section  1:  Definitions 

For  purposes  of  this  Executive  Order,  the  following  terms  shall  have  the  following 
meanings: 

"State  agency",  any  state  agency  as  defined  in  section  1  of  chapter  6A  of  the 
General  Laws; 

"Year  2000  compliant",  information  technology  that  accurately  processes 
date/time  data  (including,  but  not  limited  to,  calculating,  comparing,  and  sequencing) 
from,  into,  and  between  the  twentieth  and  twenty-first  centuries,  the  years  1999  and  2000, 
and  leap  year  calculations.  Year  2000  compliant  information  technology,  when  used  in 
combination  with  other  information  technology,  shall  accurately  process  date/time  data  if 
the  other  information  technology  properly  exchanges  date/time  data  with  it. 

Section  2:  Declaration  of  Policy 

The  chief  operational  priority  for  all  state  agencies  shall  be  to  attain  Year  2000 
compliance  on  or  before  July  1,  1999. 

The  head  of  each  state  agency  shall  be  responsible  for,  and  will  be  held 
accountable  for,  Year  2000  compliance  activities  and  performance  within  his  or  her  state 
agency.  In  cases  where  attaining  Year  2000  compliance  is  not  possible,  or  where  there  is 
an  appreciable  risk  that  a  state  agency  system  will  not  be  Year  2000  compliant,  the 
agency  heads  shall  be  responsible  for,  and  will  be  held  accountable  for,  devising  and 
implementing  a  contingency  plan  for  ensuring  uninterrupted  service  delivery. 

The  secretary  of  each  executive  office  and  the  director  of  each  department  shall 
appoint  a  senior  official  to  oversee  and  coordinate  the  Year  2000  compliance  and 
contingency  planning  activities  of  each  agency  within  his  or  her  secretariat  or  department. 
All  secretaries  and  directors  shall  be  responsible  for,  and  will  be  held  accountable  for, 
overseeing  and  coordinating  successful  contingency  planning  for  each  agency  within  their 
secretariats  or  departments. 


Section  3:  Oversight  and  Enforcement  of  Year  2000  Remediation  and  Contingency  Planning 

The  Secretary  of  Administration  and  Finance  is  hereby  directed  to  take  appropriate 
measures  to  enforce  Section  2  of  this  Executive  Order.  All  executive  agencies,  including 
specifically  the  Fiscal  Affairs  Division  and  the  Information  Technology  Division,  are 
hereby  directed  to  take  such  measures  as  the  Secretary  of  Administration  and  Finance 
may  require  to  assist  him  in  ensuring  that  all  state  agencies  attain  Year  2000  compliance. 


William  Francis  Galvin 
Secretary  of  the  Commonwealth 


GOD  SAVE  THE  COMMONWEALTH  OF  MASSACHUSETTS 
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Update  on  Outreach  to  Cities,  Towns,  and  Local  Organizations 


Commonwealth  of  Massachusetts 
Information  Technology  Division 
Year  2000  Program  Management  Office 
February  3, 1999 


The  ITD  Y2K  Program  Management  Office  (PMO)  has  been  actively  involved  in  Outreach  activities  to 
cities,  towns,  and  other  local  and  municipal  organizations.  The  following  is  an  update  of  our  outreach 
activities  since  September,  1998. 

•  The  PMO  has  been  invited  to  speak  to  a  number  of  professional  organizations  in  an  effort  to  raise 
awareness  at  the  local  level.  In  particular: 

•  The  Massachusetts  Water  Resources  Authority, 

•  The  Massachusetts  Food  Association, 

•  The  Massachusetts  Contributory  Retirement  System, 

•  The  North  Central  Massachusetts  Chamber  of  Commerce, 

•  The  Massachusetts  Emergency  Management  Agency, 

•  The  Massachusetts  Chiefs  of  Police  Technical  Committee  , 

•  The  Massachusetts  Municipal  Association, 

•  The  Computer  Museum,  and 

•  The  Federal  Emergency  Management  Agency. 

•  The  PMO  has  provided  written  responses  to  a  number  of  concerned  citizens  and  groups  that  have 
contacted  the  PMO  to  request  information  on  the  status  of  the  Commonwealth's  Y2K  readiness  and 
the  readiness  of  the  regulated  community.  The  PMO  has  responded  in  writing  to  every  request  with  a 
description  of  what  the  Commonwealth  is  doing  to  prepare  for  Y2K  as  well  as  what  the  regulatory 
agencies  are  doing  to  ensure  continuation  of  essential  services. 

•  The  PMO  regularly  publishes  Y2K  documentation  and  makes  them  available  to  not  only  state 
agencies  but  also  to  anyone  with  access  to  the  Internet.  The  PMO  is  reaching  out  to  the  citizens  of  the 
Commonwealth  through  continued  updates  of  its  Y2K  web  site.  The  PMO  staff  stay  current  on  the 
latest  information  regarding  Y2K  and  regularly  publish  articles  in  the  "Beacon",  the  official 
publication  of  the  Massachusetts  Municipal  Association  (MMA),  and  the  Information  Technology 
Division  (ITD)  quarterly  newsletter. 

Many  State  agencies  are  actively  involved  in  outreach  to  the  cities,  towns,  and  local  and  municipal 
organizations.  For  example: 

•  The  Department  of  Telecommunications  and  Energy  within  the  Office  of  Consumer  Affairs  issued 
a  Year  2000  survey  questionnaire  in  June  1998  to  all  electric,  gas,  water,  telecommunications,  and 
cable  companies  under  their  jurisdiction.  Based  on  the  July,  1998,  results  of  the  surveys,  DTE  sent 
follow-up  requests  to  theses  companies  for  more  detailed  Y2K  project  information.  Beginning 
September  25,  1998,  DTE  sponsored  technical  workshops  for  the  utility  companies  to  discuss  their 
readiness  and  to  share  information.  DTE  is  also  requiring  the  utilities  to  submit  quarterly  Y2K  status 
reports.  .  DTE  will  continue  to  survey  entities  involved  in  the  electrical  generation  and  distribution 
process,  as  well  as  conducting  technical  workshops  .  Other  activities  that  DTE  has  identified  include: 


•  Conducting  a  special  technical  workshop  for  municipalities  with  electrical  generating/distribution 

facilities. 

•  Requiring  utility  companies  to  distribute  general  Y2K  information  to  consumers  by  way  of  a  "bill 

insert". 

•  Working  closely  with  other  state  and  federal  agencies  involved  in  monitoring  and  regulating  the 

utilities,  such  as  the  US  Department  of  Energy,  ISO  New  England  and  the  North  American 
Reliability  Council. 

•  Attending  Bell  Atlantic's  quarterly  customer  interface  workshops;  and 

•  Determining  and  ensuring  that  companies'  and  municipalities'  Y2K  efforts  and  resources  are 

adequate. 

In  February  1999,  DTE  will  request  utility  company  CEO  "sign  off'  of  their  respective  Y2K 
readiness  plans.  In  addition,  utilities  will  be  required  to  submit  formal  contingency  plans  to  DTE  by 
the  end  of  the  first  quarter  of  1999.  Interface  and  monitoring  activities  will  continue  throughout  1999 
to  evaluate  utility  efforts  as  well  as  to  provide  assistance  as  needed. 

The  Division  of  Banks  within  the  Office  of  Consumer  Affairs  began  an  education  campaign  with  the 
Commonwealth  financial  institutions  in  early  1997.  On  January  22,  1999,  the  Division  of  Banks 
published  regulations  (209  CMR  51.00)  to  establish  minimum  operational  standards  for  banks  and 
credit  unions  with  respect  to  year  2000  readiness.  These  regulations  also  require  direct  involvement  of 
the  Boards  of  Directors  of  all  State  charted  banks  and  credit  unions  in  reviewing  Y2K  plans  and 
readiness.  The  Division  of  Banks  has  also  published  a  set  of  guidelines  specifying  actions  needed  to 
reach  Y2K  readiness,  testing  of  these  actions  and  preparation  of  both  business  resumption  and 
contingency  plans.  Failure  to  properly  follow  these  regulations  can  result  in  the  revocation, 
suspension  or  non-renewal  of  licenses. 

The  Department  of  Environmental  Protection  has  required  regulated  entities  to  take  whatever  steps 
are  necessary  to  ensure  continued  full  compliance  with  environmental  laws  and  regulations.  This 
responsibility  involves  identifying  and  remediating  any  Year  2000  problems  that  threaten  full 
compliance  with  environmental  laws  and  regulations.  DEP  will  not  accept  Y2K  excuses  as 
constituting  force  majeure  or  other  defense  against  environmental  enforcement  for  noncompliance. 
This  applies  both  to  Y2K  problems  arising  from  a  regulated  entity's  own  equipment  and  facilities  as 
well  as  to  problems  stemming  from  a  vendor's  facility  or  equipment.  Although  failure  to  be  Y2K 
compliant  is  not  itself  a  violation,  DEP  will  consider  failure  to  comply  with  environmental 
requirements  because  of  Y2K  problems  to  be  violations,  and  may  enforce  against  those  violations. 

The  Department  of  Revenue  began  an  awareness  campaign  two  years  ago  through  speaking 
engagements  at  various  meetings  and  conferences  of  local  officials,  and  regularly  publishes  Y2K 
articles  in  their  monthly  newspaper  "Cities  and  Towns".  To  more  formally  assist  with  outreach  to  the 
Commonwealth's  communities,  the  Secretary  of  Administration  and  Finance,  through  the  Department 
of  Revenue,  has  expanded  the  role  of  the  Division  of  Local  Services  (DLS)  to  include  a  Year  2000 
coordination  office  which  will  work  with  various  state  and  local  agencies,  in  an  attempt  to  ensure  that 
all  Commonwealth  cities,  towns,  districts  and  local  authorities  have  assessed  potential  Year  2000 
vulnerabilities.  DLS  is  also  working  to  ensure  that  local  communities  have  ready  access  to  the  best 
information  available  on  relevant  compliance  strategies.  Of  particular  concern  are  small  towns  and 
districts  that  lack  paid  technical  staffing  and  that  depend  on  part  time  elected  officials  for 
management  decisions.  This  program  began  in  December  1998  and  is  expanding  as  needs  dictate  and 
as  resources  permit.  The  program  elements  are: 


•  Small  community,  on-site  assistance:  State  assisted  inventory,  assessment,  and  planning 
(redemption/replacement,  risk  management,  contingency)  matched  with  local  funding  of 
redemption/replacement/verification  strategy. 

•  Public  Internet  tracking  of  community  progress  and  plans:  All  cities  and  towns,  districts, 
regional  agencies  and  councils  of  government  plus  related  vendors  and  suppliers. 

•  Workshops:  Coordinated  with  small  community  assistance  phases  but  open  to  all  local 
government  entities. 

•  Publications:  Related  to  overall  outreach  objectives  and  workshop  topics. 

DOR  has  mandated  that,  in  order  to  have  a  FY99  tax  rate  set,  communities  must  submit  a  report  from 
their  CFO  on  the  Y2K  compliance  status  of  all  major  municipal  computer  systems. 

The  Massachusetts  Highway  Department,  within  the  Executive  Office  of  Transportation  and 
Construction,  has  physically  inventoried  1052  state  owned  traffic  signals  and  met  with  our  three 
primary  suppliers  of  these  signals.  Information  and  testing  provided  by  the  suppliers  indicates  that 
traffic  signal  malfunctions  will  not  result  in  traffic  safety  problems.  This  premise  is  supported  by  the 
Federal  Department  of  Transportation  in  their  latest  statement  regarding  traffic  signals.  During  the 
inventory  process,  approximately  three  percent  of  our  signals  could  not  be  associated  with  a  supplier 
and  they  are  being  considered  as  sub  standard  and  being  replaced.  A  contingency  plan  is  in  the 
process  of  being  developed  and  is  scheduled  for  completion  in  February  1999.  The  Massachusetts 
Highway  Department  is  preparing  to  communicate  all  pertinent  information  to  the  cities  and  towns  of 
the  Commonwealth. 

The  Massachusetts  Emergency  Management  Agency  (MEMA),  has  initiated  planning  activities  in 
conjunction  with  Commonwealth  cities  and  towns,  the  state  police  and  other  emergency  management 
resources  to  anticipate  responses  that  may  be  required  as  a  result  of  Y2K  impact  to  citizens.  MEMA 
is  conducting  a  series  of  workshops  in  the  four  emergency  planning  districts  across  the  state  in  March 
1999  to  provide  education,  increase  citizen  awareness,  and  further  communications  with  officials  of 
cities  and  towns. 

The  Information  Technolog)  Division  legal  department  has  been  providing  assistance  on  the  legal 
issues  raised  by  the  Y2K  problem.  In  December,  the  general  counsels  from  1TD  and  A&F  conducted 
two  Y2K  legal  forums  that  were  attended  by  nearly  100  lawyers  from  state  agencies,  independent 
authorities,  and  municipalities.  The  purpose  of  these  forums  was  to  raise  awareness,  provide 
background  on  the  Y2K.  problem,  and  discuss  the  legal  aspects  of  Y2K  as  they  relate  to  the  public 
sector.  In  addition  to  these  general  sessions,  ITD's  general  counsel  has  attended  several  meetings 
with  agency  and  secretariat  lawyers  to  discuss  Y2K.  Another  series  of  Y2K  legal  forums  will  be  held 
in  mid-February,  and  periodically  thereafter.  Finally,  ITD  is  in  the  process  of  establishing  a  blanket 
contract  for  Y2K  legal  sen  ices,  so  that  agencies  will  have  a  convenient  way  to  secure  the  advice  of 
private  law  firms  that  have  developed  expertise  in  these  matters. 

On  October  30,  1998.  the  Office  of  State  Auditor  issued  a  report  as  a  result  of  their  review  of  Y2K 
readiness  for  Commonwealth  agencies  and  Authorities.  This  report  was  based  on  a  detailed  survey,  as 
well  as  on  site  interviews  and  reviews.  The  PMO  is  in  the  process  of  comparing  these  results  with 
information  independently  gathered  to  insure  a  common  position  on  Y2K  readiness. 


Mass.  Department  of  Revenue 


Division  of  Local  Services 


To: 


Joseph  J.  Chessey,  Jr.,  Deputy  Commissioner 
David  L.  Davies,  Director  of  Information  Tec 


From: 


Copy: 


Date: 


1/4/1999 


Topic: 


Y2K  LOCAL  OUTREACH  PROGRAM  -  STATUS  REPORT 


Direct  Assistance  Pilot  Program 

As  of  today,  we  have  inventoried  eleven  of  seventeen  communities  in  the  pilot  program  (another  is  scheduled  for 
next  week  and  one  is  in  the  process  of  being  scheduled).  Four  towns  have  not  responded  to  the  opportunity. 

Preliminary  findings  conform  to  our  expectations:  there  is  a  wide  range  of  Y2K  compliance  awareness  and 
activity  in  smaller  communities.  Many  non-compliant  systems  are  in  place  with  no  plans  to  upgrade  or  replace. 
On  the  other  hand,  some  smaller  communities  have  seriously  assessed  their  vulnerabilities  and  have  procured 
solutions.  All  communities  that  responded  to  the  pilot  appeared  to  be  genuinely  appreciative  of  the  state 
assistance,  regardless  of  their  degree  of  compliance. 

Four  different  DLS  staff  persons  were  able  to  inventory  town  systems  in  about  four  hours  per  community  ~  our 
original  estimate.  There  is  usually  follow-up  work  by  phone,  but  the  pilot  experience  indicates  that  successful 
expansion  of  the  program  to  all  communities  under  5000  population  is  realistic. 

We  are  prepared  to  highlight  the  program  at  next  week's  Y2K  workshop  at  the  MMA  Annual  Conference  and  the 
pending  front  page  article  for  next  month's  City  &  Town  discusses  the  Local  Outreach  program,  the  pilot,  and 
DLS  plans  to  expand  direct  assistance. 

Internet  Clearinghouse 

DLS  staff  have  developed  a  preliminary  database  model  and  are  mocking  up  a  static  Website  that  can  be 
activated  in  January,  to  be  replaced  by  the  Oracle-driven  site  the  following  month. 

W.T.  Chen  declined  to  submit  a  proposal  on  the  Oracle  project,  citing  lack  of  appropriate  staff  resources  on  short 
notice.  Oracle  Consulting  is  preparing  a  proposal  and  freeing  up  two  consultants  for  this  work.  I  have  stipulated 
that  we  want  these  consultants  to  work  with  DLS  and  ISO  staff  so  that  DOR  staff  can  expand  and  enhance  this 
technology  for  this  and  other  projects.  ISO  stands  ready  to  implement  this  Clearinghouse  on  their  new  Oracle 
Web  and  database  servers  and  to  collaborate  with  DLS  staff  in  administering  the  database. 

Vendor/Supplier  Outreach 

We  want  to  involve  private  firms  supplying  products  and  services  to  local  governments  to  the  fullest  extent 
possible  in  reporting  their  compliance  status  through  the  Clearinghouse  and  publications.  DLS  &  ITD  lawyers 
are  currently  reviewing  a  draft  letter  to  invite  their  reporting  of  compliance  testing  and  status.  We  would  like  to 
send  that  letter  out  this  week  to  the  vendors  already  identified. 

0-3  Staffing 

We  are  processing  forms  for  a  Project  Manager,  one  full  time  and  one  part  time  inventory  specialist,  and  two 
graduate  student  interns.  The  DOR  tax  and  background  checks  will  take  a  couple  of  weeks  at  best. 


Publications 


We  have  begun  planning  on  one  specific  publication  —  a  looseleaf  subscription  service  that  will  make 
continuously  updated  information  from  the  Clearinghouse  available  to  citizens  and  officials  who  do  not  have 
access  to  the  Internet,  i.e.  one  copy  for  each  municipal  library  and  clerk's  office. 

Workshops 

We  have  had  preliminary  discussions  with  Emergency  Management  on  coordinating  outreach  workhops  on 
contingency  planning.  Problems  with  emergency  services,  electrical  power,  and  water  supply/sewer  services  are 
typically  the  greatest  concerns  of  citizens  in  Y2K  forums. 

Schools,  Housing  Authorities,  and  Other  Local  Entities 

We  have  contacted  various  knowledgeable  officials  to  verify  the  status  of  compliance  awareness  and  outreach 
activities.  Follow-up  will  occur  after  the  Direct  Assistance  and  Clearinghouse  projects  are  fully  on  track. 


DRAFT  -  FOR  DISCUSSION  PURPOSES  ONLY 
1/5/99 

Dear  {VENDOR) 

The  Division  of  Local  Services  will  soon  activate  a  Local  Government  Y2K  Clearinghouse 
Website.  This  Website  will  present  constantly  updated  information  on  local  government  Y2K 
compliance  with  links  to  vendor  information,  Internet  sites,  and  compliance  certification  letters. 
Attached  is  a  letter  from  your  firm  that  states  the  compliance  status  of  your  products  relative  to 
Massachusetts  cities  and  towns.  Local  Services  wishes  to  publish  the  most  current  and  accurate 
information  relative  to  your  firm's  products  and  services  to  guide  local  officials  seeking  compliant 
solutions.  If,  therefore,  you  provide  this  office  with  an  updated  certification  statement,  a  detailed 
breakdown  of  compliance  relative  to  different  versions  or  models,  specifics  on  where  and  how  products 
were  tested,  or  other  information  or  links  appropriate  to  this  Clearinghouse,  we  will  substitute  existing 
data  with  the  updates. 

Statements  of  Y2K  compliance  can  go  beyond  the  products  and  services  sold  to  local 
governments.  It  can  include,  for  example,  whether  a  firm  has  assessed  its  own  vulnerabilities  relative  to 
internal  systems  and/or  external  suppliers  and  wishes  to  share  that  analysis  with  its  customers. 

Local  Services  will  not  publish  vendor  specific  information  unless  it  has  been  provided  by  the 
vendor  either  directly  to  this  Department,  in  correspondence  with  Massachusetts  cities  and  towns,  or 
through  its  general  publications  or  Internet  site.  If  your  product  relies  on  third  party  technology,  such  as 
a  database  system  or  report  writer,  Local  Services  may  report  on  that  vendor's  compliance  status  and 
provide  a  link  to  your  product. 

In  general,  the  Division  of  Local  Services  wishes  to  assist  local  governments  and  the  vendor 
community  in  providing  an  efficient  resource  for  identifying  tested  solutions  and  Y2K  compliant 
companies.  We  welcome  any  and  all  comments  and  suggestions  on  how  to  make  this  project  fulfill  that 
objective  while  addressing  any  concerns  you  may  have. 

Yours  truly, 
David  L.  Davies 

Director  of  Information  Technology 
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DLS  Pilots  Y2K  Outreach 

During  the  past  two  years  the  Division  of  Local  Services  (DLS)  has  been  alerting  cities  and  towns  to 
the  potential  of  computer  system  failures  because  of  Year  2000  (Y2K)  programming  errors.  While 
the  early  focus  of  those  worrying  about  the  millennium  bug  was  on  large  federal  and  state 
agencies,  the  spotlight  has  shifted  to  municipal  government.  Surveys  show  the  public  places  a  high 
priority  on  uninterrupted  vital  municipal  services.  With  just  11  months  left,  it  is  time  to  make  the 
final  preparations. 

DLS  has  organized  an  ambitious  Y2K  outreach  program  to  municipalities.  The  program  will  provide 
on-site  staff  assistance  to  small  towns  in  assessing  vulnerabilities  and  create  a  central  Web-based 
clearinghouse  for  compliance  data  on  products  and  community  status. 

Y2K  Outreach  Program 

DLS  staff  has  tested  the  outreach  program  by  providing  assistance  to  small  towns  that  do  not  have 
paid  technical  staff.  Outreach  staff  is  conducting  inventories  in  municipal  governments,  school 
districts,  housing  authorities,  utility  districts,  etc.  The  community  must  agree  that  it  retains 
responsibility  for  the  accuracy  of  data  collected  and  the  appropriateness  of  the  proposed  solutions. 
The  program  includes: 

•  hardware,  software,  and  embedded  device  inventories, 

•  vendor  management  program  development, 

•  non-compliant  system  assessments, 

•  remediation  or  replacement  strategy  recommendations  and 

•  community  specific  risk  management  and  contingency  plans. 

For  outreach  recommendations  to  be  beneficial  they  should  be  part  of  FY2000  budget  deliberations 
and  creation  of  Y2K  contingency  accounts.  DLS  began  testing  the  program  last  month  in  17  of  the 
100  communities  with  populations  under  5,000.  At  this  writing  half  of  the  inventories  are  done  and 
preliminary  community  results  show: 

•  many  have  Y2K  vulnerabilities  because  they  rely  on  older  non-compliant  vendor 
programs  in  the  interest  of  economy, 

•  communities  are  aware  of  Y2K  issues  to  varying  degrees  and  are  purchasing  hardware 
and  software  with  compliance  in  mind, 

•  many  assume  Y2K  compliance  relates  only  to  financial  systems  consequently  public 
safety,  utilities,  etc.,  receive  less  scrutiny, 

•  suppliers  and  service  vendors  are  seldom  queried  on  their  Y2K  status,  and 

•  many  communities  trust  verbal  compliance  assurances  on  products  without  specification 
of  what  compliance  means. 

DLS  believes  that  it  can,  with  full  community  cooperation,  inventory  all  100  communities.  Also, 
once  those  goals  are  met  we  will  offer  assistance  to  larger  communities. 


Web-based  Clearinghouse 
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Currently  DLS  is  creating  an  Internet  Y2K  compliance  clearinghouse.  Information  gathered  by  DLS 
will  be  posted  to  a  database  that  can  be  searched  by  community,  department,  product,  vendor, 
and  downloaded.  For  example,  someone  discovers  that  an  embedded  chip  in  a  specific  model  water 
pump  is  not  Y2K  compliant,  and  DLS  posts  that  information.  A  local  official  elsewhere  is  worried 
about  water  system  compliance  and  searches  by    water  supply  or  pump  or  vendor  name .  The 
searcher  could  discover  the  water  system's  compliant  status,  where  else  it  is  used  in 
Massachusetts,  the  vendor's  proposed  solution,  their  website,  email  address,  and  product 
certifications.  Data  on  alternative  compliant  pumping  systems  can  also  be  found.  While  the 
clearinghouse  website  is  under  construction  we  will  create  a  static  (non-searchable)  Internet  site 
to  get  this  information  out  as  soon  as  possible.  As  with  all  Year  2000  programs,  time  is  of  the 
essence. 

Plans  also  include  a  Year  2000  Compliance  Web  page  for  each  community  with  a  message  from  the 
community's  executives.  There  will  be  links  to  the  community's  Y2K  assessment  and  contingency 
plans.  Cities,  towns  and  businesses  are  welcome  to  link  to  their  sites.  The  clearinghouse  can  also 
be  a  procurement  resource  as  the  search  for  solutions  intensifies. 

Workshops  and  Publications 

DLS  is  working  with  other  agencies  and  associations  to  organize  regional  workshops  for  non- 
technical local  leaders.  Workshop  topics  and  related  publications  will  focus  on  topics,  like 
contingency  planning,  that  relate  to  the  decisions  facing  local  officials  and  the  concerns  of  their 
constituents  as  the  year  2000  approaches. 

Media  attention  will  increasingly  make  Y2K  preparedness  an  issue  of  citizens'  concern.  Some  larger 
jurisdictions  in  the  country  are  preparing  Y2K  contingency  plans  similar  to  emergency 
management  planning  for  a  blizzard  or  hurricane.  Individuals  and  citizen  groups  throughout 
Massachusetts  are  already  considering  what  precautionary  steps  to  take  in  anticipation  of  whatever 
happens.  Because  DLS  knows  that  many  Massachusetts  communities  use  similar  systems  and  face 
common  problems,  we  are  working  to  simplify  the  search  for  compliance  verifications  or  common 
solutions.  Well  informed  municipal  officials  can  more  effectively  guide  their  communities  through  a 
unique  period  of  time  in  which  experts  disagree  and  the  average  citizen  does  not  know  what  to 
think.  Verification  of  local  systems  is  a  small  part  of  the  whole  problem,  but  a  very  important 
part. 
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Year  2000  Compliance 
Local  Outreach  Program 

Terms  of  Engagement 

The  Commonwealth  will  provide  direct  assistance  in  preparing  inventories,  assessments,  and  plans 
relative  to  Year  2000  compliance  of  systems,  devices,  vendors,  and  suppliers.  The  community  hereby 
accepts  this  assistance  under  the  following  three  conditions: 

1 .  The  community  shall  retain  full  responsibility  for  the  accuracy  and  completeness  of  inventories 
and  assessments  developed  with  and  without  assistance  of  analysts  provided  by  the  Commonwealth. 
The  community  shall  be  fully  responsible  for  the  content  of  any  plans  or  recommendations  prepared 
with  or  without  the  assistance  of  Commonwealth  analysts  for  community  review  and  approval  once 
those  plans  or  recommendations  have  been  duly  adopted  by  the  communty. 

2.  The  community  shall  take  reasonable  steps  to  make  appropriate  officials  available  for 
consultation,  initial  and  follow-up,  in  order  to  ensure  that  assistance  can  be  provided  in  an  efficient  and 
responsive  manner. 

3.  If  tests  are  run  on  community  systems,  with  the  explicit  permission  of  the  responsible  local 
officials,  it  is  the  community's  responsibility  to  ensure  that  appropriate  precautionary  steps,  such  as 
verified  full  system  backups,  have  been  taken.  In  no  event  shall  the  Commonwealth  be  liable  for  claims 
by  the  community  or  third  parties  that  such  tests  have  damaged  hardware,  software,  or  data  involved 
with  those  systems. 

FOR  THE  TOWN  OF 


DATE 


* 


EXPY2KP 


MASSACHUSETTS  DEPARTMENT  OF  REVENUE 
DIVISION  OF  LOCAL  SERVICES 
MUNICIPAL  DATA  BANK 


FILE  DESC:  FY96  GENERAL  FUND  EXPENDITURES.(Excluding  Capital  Outlay  and  Constrution) 


date:  01/04/99        Y2K  Local  Outreach  Pilot 


 Estimated 

DOR  1996 


JDC    Municipality  Population  

i  SCHED    DONE      READY  WAITING 


297  TOLLAND 

297  YES 

0 

1 

0 

0 

233  PERU 

753  WAITING 

0 

0 

0 

1  No  response 

204  NEW  SALEM 

825  YES 

0 

1 

0 

0 

108  GOSHEN 

851  READY 

0 

0 

1 

0  Awaiting  scheduling 

349  WORTHINGTO 

1,210  SCHED 

0 

1 

0 

0 

203  NEW  MARLBO 

1,262  YES 

0 

1 

0 

0 

112  GRANVILLE 

1,404  YES 

0 

1 

0 

0 

300  TRURO 

1,729  YES 

0 

1 

0 

0 

154  LEVERETT 

1,835  WAITING 

0 

0 

0 

1  No  response 

135  HOLLAND 

2,105  WAITING 

0 

0- 

0 

1  No  response 

188  MILLVILLE 

2,432  WAITING 

0 

1 

0 

0 

43  BRIMFIELD 

3,093  YES 

0 

1 

0 

0 

289  SUNDERLAND 

3,519  YES 

0 

1 

0 

0 

250  ROCHESTER 

4,393  YES 

0 

1 

0 

0 

21  BARRE 

4,805  SCHED 

0 

1 

0 

0 

254  ROWLEY 

5,196  SCHED 

1 

0 

0 

0 

27  BERKLEY 

5,236  WAITING 

0 

0 

0 

1  No  response 

TOTALS 

/ 

11 

1 
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Massachusetts  Division  Of  Banks 


Year  2000  Operational  Safety  and  Soundness  Standards 
Final  Proposed  Regulations 
Effective  January  22,  1999 


209  CMR  51.00  -  Year  2000  Safety  and  Soundness  Standards 

The  following  Sections  are  listed  below: 

51.01:  Purpose  and  Scope 
51.02:  Definitions 

51.03:  Year  2000  Readiness  Minimum  Standards 
51.04:  Sanctions 
51.05:  Severability 
51.06:  Sunset 

51.01:  Purpose  and  Scope 

The  purpose  of  209  CMR  51.00  et  seq.  is  to  establish  minimum  operational  standards  for  banks  and 
credit  unions  with  respect  to  Year  2000  Readiness.  The  safe  and  sound  operation  of  banks  and  credit 
unions  requires  that  management  take  appropriate  and  timely  steps  to  ensure  that  record- keeping  and 
other  mission  critical  systems  are  Year  2000  compliant. 

209  CMR  51.00  also  sets  out  the  range  of  remedial  or  enforcement  actions  and  sanctions  that  may  be 
imposed  by  the  Division  for  banks  and  credit  unions  that  are  not  in  compliance  with  federal  guidelines 
and  safety  and  soundness  standards  relative  to  Year  2000  readiness.  The  provisions  of  209  CMR  51.00 
are  minimum  record- keeping  or  operational  standards  for  state- chartered  banks  and  credit  unions 
These  provisions  are  independent  of,  and  in  addition  to,  the  Division's  authority  to  take  any  other 
remedial  action  under  applicable  state  law. 

51.02:  Definitions 

As  used  in  209  CMR  5 1 .00  et  seq.,  the  following  words  shall,  unless  the  context  otherwise  requires, 
have  the  following  meanings: 

Bank.  A  bank  shall  include  a  state- chartered  savings  bank,  co-operative  bank  or  trust  company  or  any 
other  association  or  corporation,  as  defined  by  M.G.L.  c.  167  §  1,  that  is  subject  to  supervision  and 
examination  by  the  Division. 

Credit  Union.  A  credit  union  as  defined  by  M.G.L.  c.  171  §  1,  that  is  subject  to  supervision  and 
examination  by  the  Division  pursuant  to  M.G.L.  c.  167  §  2. 

Division.  The  Division  of  Banks,  including  the  Commissioner  of  Banks. 
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Federal  Bank  Regulatory  Agency.  The  Federal  Deposit  Insurance  Corporation,  the  Board  of 
Governors  of  the  Federal  Reserve  System,  the  Office  of  the  Comptroller  of  the  Currency,  the  Office  of 
Thrift  Supervision,  or  the  National  Credit  Union  Administration  or  any  other  applicable  federal  bank 
regulatory  agency. 

Federal  Year  2000  Guidelines.  The  written  guidance  papers  issued  by  the  FFIEC  in  the  areas  of  Year 
2000  project  planning,  renovation,  testing,  contingency  planning,  and  the  impact  of  the  century  change 
date.  The  term  includes  the  eight  guidance  papers  published  as  of  October  15,  1998  and  any 
subsequent  guidance  papers  issued  by  the  FFIEC.  The  Federal  Year  2000  Guidelines  provide  guidance 
to  federally  insured  depository  institutions  and  set  out  the  federal  bank  regulatory  agencies' 
supervisory  policies  relative  to  such  depository  institutions'  minimum  Year  2000  remediation 
requirements. 

Federal  Year  2000  Safety  and  Soundness  Guidelines.  Written  standards  promulgated  by  the  federal 
bank  regulatory  agencies  under  12  U.S.C.  §  181 8p- 1 .  These  "Interagency  Guidelines  Establishing  Year 
2000  Standards  for  Safety  and  Soundness"  became  effective  upon  their  October  15,  1998  publication. 
(63  Federal  Register  55,479  (1998)).  The  guidelines  are  judicially  enforceable  under  the  "prompt 
correct  action"  provisions  of  12  U.S.C.  §  1818o. 

FFIEC.  The  Federal  Financial  Institutions  Examination  Council,  a  federal  body  established  pursuant  to 
12  U.S.C.  §  3301  et  seq.,  which  coordinates  and  promotes  uniform  supervisory  and  examination 
policies  among  the  federal  bank  regulatory  agencies  and  state  bank  supervisors. 

51.03  Year  2000  Readiness  Minimum  Standards 

(1)  All  banks  and  credit  unions  shall  take  all  necessary  steps  and  measures  to  adhere  to  and  implement 
the  Federal  Year  2000  Guidelines. 

(2)  All  banks  shall  be  in  compliance  with  the  Federal  Year  2000  Guidelines  and  Federal  Year  2000 
Safety  and  Soundness  Guidelines  at  all  times.  Failure  to  review,  renovate  and  test  internal  and  external 
mission  critical  systems;  or  to  develop  and  implement  business  resumption  or  remediation  contingency 
plans;  or  to  appropriately  identify  customer  risks  in  accordance  with  the  Federal  Year  2000  Safety  and 
Soundness  Guidelines  shall  trigger  M.G.L.  c.  167  §22.  Such  failure  shall  establish  that  a  bank,  (a)  is 
"conducting  business  in  an  unsafe  and  unauthorized  manner";  (b)  is  transacting  business  in  an  "unsound 
or  unsafe  condition";  and  (c)  has  violated  a  "law  of  the  commonwealth"  within  the  meaning  of  M.G.L 
c.  167  §22. 

(3)  All  credit  unions  shall  be  in  compliance  with  the  Federal  Year  2000  Guidelines  at  all  times  Failure 
to  review,  renovate  and  test  internal  and  external  mission  critical  systems;  or  to  develop  and  implement 
business  resumption  or  remediation  contingency  plans;  or  to  appropriately  identify  customer  risks  in 
accordance  with  the  Federal  Year  2000  Guidelines  shall  trigger  M.G.L.  c.  167  §22.  Such  failure  shall 
establish  that  a  credit  union:  (a)  is  "conducting  business  in  an  unsafe  and  unauthorized  manner";  (b)  is 
transacting  business  in  an  "unsound  or  unsafe  condition";  and  (c)  has  violated  a  "law  of  the 
commonwealth"  within  the  meaning  of  M.G.L.  c.  167  §22. 

(4)  (a)  Banks.  The  Division,  in  its  discretion,  may  impose  any  or  all  of  the  sanctions  under  209  CMR 
51.04,  under  the  following  circumstances: 
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1.  If  a  report  of  examination  conducted  by  the  Division  or  a  federal  bank  regulatory  agency  determines 
that  a  bank  is  not  in  compliance  with  the  Federal  Year  2000  Guidelines  by  virtue  of  receiving  a  "Needs 
to  improve"  or  "Unsatisfactory"  rating  during  or  after  the  mission  critical  systems  testing  stage, 

2.  The  bank  fails  to  take  immediate  and  satisfactory  corrective  action  as  directed  by  the  Division  or  a 
federal  bank  regulatory  agency;  or 

3.  The  bank  is  not  in  compliance  with  the  Federal  Year  2000  Safety  and  Soundness  Guidelines  and  has 
been  issued  an  order  pursuant  to  12  U.S.C.  §  181 8o. 

(b)  Credit  Unions.  The  Division,  in  its  discretion,  may  impose  any  or  all  of  the  sanctions  under  209 
CMR  51.04,  under  the  following  circumstances: 

1 .  If  a  report  of  examination  conducted  by  the  Division  or  a  federal  bank  regulatory  agency  determines 
that  a  credit  union  is  not  in  compliance  with  the  Federal  Year  2000  Guidelines  by  virtue  of  receiving  a 
"Medium"  or  "High  Risk"  rating; 

2.  The  credit  union  fails  to  take  immediate  and  satisfactory  corrective  action  as  directed  by  the  Division 
or  a  federal  bank  regulatory  agency,  or 

3.  The  credit  union  is  not  in  compliance  with  a  Year  2000  regulatory  directive. 

(c)  Corrective  action.  Failure  to  take  satisfactory  corrective  action  shall  include,  but  is  not  limited  to, 
failing  to  submit  an  acceptable  corrective  action  plan  or  submitting  a  corrective  plan  that  is  rejected  or 
deemed  unacceptable  by  the  Division  or  by  an  applicable  federal  bank  regulatory  agency  or  the 
issuance  of  a  "safety  and  soundness  order"  pursuant  to  12  U.S.C.  §  1 8 1 8o. 

51.04  Sanctions 

Failure  to  comply  with  209  CMR  51.03  shall  constitute  grounds  for  the  imposition  of  the  following 
sanctions: 

(a)  the  issuance  of  an  order  pursuant  to  M.G.L.  c.  167  §  3; 

(b)  the  suspension  or  removal  of  officers,  directors  or  trustees  pursuant  to  M.G.L.  c.  167  §  3; 

©  the  notification,  certification  or  consolidation  of  an  excess  deposit  insured  savings  bank,  co- 
operative bank  or  credit  union  pursuant  to  St.  1934  c.43;  St.  1934  c.73,  or  St.  1961  c.294, 
respectively; 

(d)  the  appointment  of  a  conservator  pursuant  to  M.G.L.  c.  172  §  §  40-46,  or  other  applicable  statutes. 

(e)  the  taking  possession  and  control  of  the  bank  or  credit  union  pursuant  to  M.G.L.  c.  167  §  22;  or. 

(f)  the  appointment  of  a  receiver  pursuant  to  M.G.L.  c.  167  §  26  or  M.G.L.  c.  167  §26A,  as  the  case 
may  be. 

51.05:  Severability 
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If  any  provision  of  209  CMR  51.00,  or  the  application  thereof  to  any  person  or  circumstance  is  for  any 
reason  held  to  be  invalid,  the  remainder  of  209  CMR  51.00  and  the  application  of  such  provisions  to 
other  persons  or  circumstances  shall  not  be  affected  thereby. 

51.06:  Sunset 

209  CMR  51.00  shall  expire  on  December  31,  2001. 
REGULATORY  AUTHORITY:  M.G.L.  c.  167  §6;  c.  30A  §  8. 

Return  to  Regulations 

Return  to  DOB  Homepage 
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Massachusetts  Division  Of  Hanks 


Proposed  Licensee  Year  2000  Operational  Safety  and  Soundness  Standards 

Regulatory  Bulletin 
Applicable  to  Licensees  Only 
Comment  Period  Open  Thru  January  19,  1999 


Guidelines  Establishing  Year  2000  Standards  for  Safety  and 

Soundness 

L  APPLICABILITY  AND  SCOPE 

The  purpose  of  this  bulletin  is  to  establish  minimum  operational  standards  for  licensees  with 
respect  to  Year  2000  Readiness.  The  safe  and  sound  operation  of  licensees  requires  that 
management  take  appropriate  and  timely  steps  to  ensure  that  record- keeping  and  other  mission 
critical  systems  are  Year  2000  compliant.  Applicants  are  expected  to  be  in  compliance  with  the 
bulletin  prior  to  applying  for  a  license. 

This  bulletin  also  sets  out  the  range  of  remedial  or  enforcement  actions  and  sanctions  that  may 
be  imposed  by  the  Division  of  Banks  (Division)  for  licensees  that  are  not  in  compliance  with 
these  guidelines  and  safety  and  soundness  standards  relative  to  Year  2000  readiness.  The 
provisions  of  this  bulletin  are  minimum  record- keeping  or  operational  standards  for  licensees 
These  provisions  are  independent  of,  and  in  addition  to,  the  Division's  authority  to  take  any 
other  remedial  action  under  applicable  state  law. 

This  bulletin  is  applicable  to  all  licensees. 

n.  DEFINITIONS 

The  following  definitions  apply  to  the  terms  used  in  this  bulletin  unless  the  context  otherwise 
requires: 

Business  resumption  contingency  plan  means  a  plan  that  describes  how  mission-  critical 
systems  of  the  licensee  will  continue  to  operate  in  the  event  there  are  system  failures  in 
processing,  calculating,  comparing,  or  sequencing  date  or  time  data  from,  into,  or  between  the 
20th  and  21st  centuries;  or  the  years  1999  and  2000;  or  with  regard  to  leap  year  calculations. 

External  system  means  a  system  the  renovation  of  which  is  not  controlled  by  the  licensee, 
including  systems  provided  by  service  providers  and  any  interfaces  with  external  third  party 
suppliers  and  other  material  third  parties. 

External  third  party  supplier  means  a  service  provider  or  software  vendor  that  supplies 
services  or  products  to  licensees. 


http://www.magnet.state.ma.us/dob/reg2_y2k.htm 


1/22/99 


Page  2  of  7 


Internal  system  means  a  system  the  renovation  of  which  is  controlled  by  the  licensee,  including 
software,  operating  systems,  mainframe  computers,  personal  computers,  readers/sorters,  and 
proof  machines.  Internal  system  also  may  include  a  system  controlled  by  the  licensee  with 
embedded  integrated  circuits  (e.g.,  heating  and  cooling  systems,  vaults,  communications, 
security  systems,  and  elevators). 

Licensee  means  any  person  who  is  licensed  by  the  Commissioner  as  a  collection  agency  under 
G.L.  c.  93;  a  small  loan  agency  under  G.L.  c.  140;  a  check  seller  under  G.L.  c.  167F;  a  foreign 
transmittal  agency  under  G.L.  c.  169;  a  check  casher  under  G.L.  c.  169A;  a  motor  vehicle  sales 
finance  company  under  G.L.  c.  255B;  an  insurance  premium  finance  agency  under  G.L.  c.  255C; 
a  retail  installment  sales  and  service  company  under  G.L.  c.  255D;  or  a  mortgage  lender  or 
mortgage  broker  under  G.L.  c.  25 5E. 

Mission-  critical  system  means  an  application  or  system  that  is  vital  to  the  successful 
continuance  of  a  core  business  activity.  An  application  or  system  may  be  mission- critical  if  it 
interfaces  with  a  designated  mission- critical  system.  Software  products  also  may  be  mission- 
critical. 

Other  material  third  party  means  a  third  party,  other  than  an  external  third  party  supplier,  to 
whom  an  licensee  transmits  data  or  from  whom  an  licensee  receives  data,  including  business 
partners  (e.g.,  credit  bureaus),  other  licensees,  payment  system  providers,  clearinghouses, 
customers,  and  utilities 

Remediation  contingency  plan  means  a  plan  that  describes  how  the  licensee  will  mitigate  the 
risks  associated  with  the  failure  to  successfully  complete  renovation,  testing,  or  implementation 
of  its  mission-critical  systems 

Renovation  means  code  enhancements,  hardware  and  software  upgrades,  system  replacements, 
and  other  associated  changes  that  ensure  that  the  licensee's  mission-  critical  systems  and 
applications  are  Year  2000  ready. 

Year  2000  ready  or  readiness  with  respect  to  a  system  or  application  means  the  system  or 
application  accurately  processes,  calculates,  compares,  or  sequences  date  or  time  data  from, 
into,  or  between  the  20th  and  21st  centuries;  or  the  years  1999  and  2000;  or  with  regard  to  leap 
year  calculations. 

ED.  YEAR  2000  STANDARDS  FOR  SAFETY  AND  SOUNDNESS 

A.  Review  of  Mission-Critical  Systems  For  Year  2000  Readiness 

Each  licensee  shall  in  writing: 

1    Identify  all  internal  and  external  mission-critical  systems  that  are  not  Year  2000 
ready; 

2.   Establish  priorities  for  accomplishing  work  and  allocating  resources  to  renovating 
internal  mission-critical  systems; 
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3.  Identify  the  resource  requirements  and  individuals  assigned  to  the  Year  2000  project 
on  internal  mission-critical  systems; 

4.  Establish  reasonable  deadlines  for  commencing  and  completing  the  renovation  of 
such  internal  mission-critical  systems; 

5.  Develop  and  adopt  a  project  plan  that  addresses  the  licensee's  Year  2000 
renovation,  testing,  contingency  planning,  and  management  oversight  process;  and 

6.  Develop  a  due  diligence  process  to  monitor  and  evaluate  the  efforts  of  external  third 
party  suppliers  to  achieve  Year  2000  readiness. 

B.  Renovation  of  Internal  Mission-Critical  Systems. 

Each  licensee  should  have  commenced  renovation  of  all  internal  mission- critical  systems 
that  are  not  Year  2000  ready  in  sufficient  time  that  testing  of  the  renovation  could  be 
substantially  completed  by  December  31,  1998. 

C.  Renovation  of  External  Mission-Critical  Systems 

Each  licensee  shall: 

1.  Determine  the  ability  of  external  third  party  suppliers  to  renovate  external  mission- 
critical  systems  that  are  not  Year  2000  ready  and  to  complete  the  renovation  in 
sufficient  time  to  substantially  complete  testing  by  March  31,  1999; 

2.  Maintain  written  documentation  of  all  its  communications  with  external  third  party 
suppliers  regarding  their  ability  to  renovate  timely  and  effectively  external  mission- 
critical  systems  that  are  not  Year  2000  ready;  and 

3.  Develop  in  writing  an  ongoing  due  diligence  process  to  monitor  and  evaluate  the 
efforts  of  external  third  party  suppliers  to  achieve  Year  2000  readiness,  including 

a.  monitoring  the  efforts  of  external  third  party  suppliers  to  achieve  Year  2000 
readiness  on  at  least  a  quarterly  basis  and  documenting  communications  with 
these  suppliers;  and 

b.  reviewing  the  licensee's  contractual  arrangements  with  external  third  party 
suppliers  to  determine  the  parties'  rights  and  obligations  to  achieve  Year 
2000  readiness. 

D.  Testing  of  Mission-Critical  Systems. 

Each  licensee  shall  have: 

1 .  Developed  and  implemented  an  effective  written  testing  plan  for  both  internal  and 
external  systems.  Such  a  plan  shall  include  the  testing  environment,  testing 
methodology,  testing  schedules,  budget  projections,  participants  to  be  involved  in 
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testing,  and  the  critical  dates  to  be  tested  to  achieve  Year  2000  readiness; 

2.  Verified  the  adequacy  of  the  testing  process  and  validated  the  results  of  the  tests 
with  the  assistance  of  the  project  manager  responsible  for  Year  2000  readiness,  the 
owner  of  the  system  tested,  and  an  objective  independent  party  (such  as  an  auditor, 
a  consultant,  or  a  qualified  individual  from  within  or  outside  of  the  licensee  who  is 
independent  of  the  process  under  review); 

3 .  Substantially  completed  testing  of  internal  mission-critical  systems  by  December  3 1 , 
1998.  Any  licensee  that  did  not  complete  such  testing  by  December  31,  1998  shall 
notify  the  Division  when  such  testing  will  be  complete  as  well  as  explain  why  such 
testing  was  not  complete  by  the  deadline; 

4.  Commenced  testing  of  external  mission-critical  systems  by  January  1,  1999; 

5.  Substantially  completed  testing  of  external  mission-critical  systems  by  March  3 1 , 
1999; 

6.  Commenced  testing  with  other  material  third  parties  by  March  31,  1999;  and 

7.  Completed  testing  of  all  mission-critical  systems  by  June  30,  1999. 

£.  Business  Resumption  Contingency  Planning 

Each  licensee  shall  develop  and  implement  an  effective  written  business  resumption 
contingency  plan  that,  at  a  minimum: 

1 .  Defines  scenarios  for  mission-critical  systems  failing  to  achieve  Year  2000 
readiness; 

2.  Evaluates  options  and  selects  a  reasonable  contingency  strategy  for  those  systems, 

3.  Provides  for  the  periodic  testing  of  the  business  resumption  contingency  plan;  and 

4.  Provides  for  independent  testing  of  the  business  resumption  contingency  plan  by  an 
objective  independent  party,  such  as  an  auditor,  consultant,  or  qualified  individual 
from  another  area  of  the  licensee  who  was  not  involved  in  the  formulation  of  the 
business  resumption  contingency  plan. 

F.   Remediation  Contingency  Planning. 

Each  licensee  that  has  failed  to  successfully  complete  renovation,  testing,  and 
implementation  of  a  mission- critical  system,  or  is  in  the  process  of  remediation  and  is  not 
on  schedule  with  the  key  dates  in  section  II. D,  shall  develop  and  implement  an  effective 
written  remediation  contingency  plan  that,  at  a  minimum: 

1 .  Outlines  the  alternatives  available  if  remediation  efforts  are  not  successful,  including 
the  availability  of  alternative  external  third  party  suppliers,  and  selects  a  reasonable 
contingency  strategy;  and 
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2.  Establishes  trigger  dates  for  activating  the  remediation  contingency  plan,  taking  into 
account  the  time  necessary  to  convert  to  alternative  external  third  party  suppliers  or 
to  complete  any  other  selected  strategy. 

G.  Customer  Risk 

Each  licensee  shall  develop  and  implement  a  written  due  diligence  process  that: 

1 .  Identifies  customers,  including  fund  providers,  fund  takers,  and  capital  market/asset 
management  counterparties,  that  represent  material  risk  exposure  to  the  licensee, 

2.  Evaluates  their  Year  2000  preparedness; 

3.  Assesses  their  existing  and  potential  Year  2000  risk  to  the  licensee;  and 

4.  Implements  appropriate  risk  controls,  including  controls  for  underwriting  risk,  to 
manage  and  mitigate  their  Year  2000  risk  to  the  licensee. 

H.  Involvement  of  the  Board  of  Directors  and  Management. 

1 .  During  all  stages  of  the  renovation,  testing,  and  contingency  planning  process,  the 
board  of  directors  and  management  of  each  licensee  shall: 

a.  be  actively  involved  in  managing  efforts  to  plan,  allocate  resources,  and 
monitor  progress  towards  attaining  Year  2000  readiness; 

b.  oversee  the  efforts  of  the  licensee  to  achieve  Year  2000  readiness  and  allocate 
sufficient  resources  to  resolve  problems  relating  to  the  licensee's  Year  2000 
readiness;  and 

c.  evaluate  the  Year  2000  risk  associated  with  any  strategic  business  initiatives 
contemplated  by  the  licensee,  including  mergers  and  acquisitions,  major 
systems  development,  corporate  alliances,  and  system  interdependencies. 

2.  In  addition,  the  board  of  directors,  at  a  minimum,  shall  require  from  management, 
and  management  shall  provide  to  the  board  of  directors,  written  status  reports,  at 
least  quarterly  and  as  otherwise  appropriate  to  keep  the  directorate  fully  informed, 
of  the  licensee's  efforts  in  achieving  Year  2000  readiness.  Such  written  status 
reports  shall,  at  a  minimum,  include: 

a.  The  overall  progress  of  the  licensee's  efforts  in  achieving  Year  2000 
readiness; 

b.  The  licensee's  interim  progress  in  renovating,  validating,  and  contingency 
planning  measured  against  the  licensee's  Year  2000  project  plan  as  adopted 
under  section  III.  A.  5; 

c.  The  status  of  efforts  by  key  external  third  party  suppliers  and  other  material 
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third  parties  in  achieving  Year  2000  readiness; 


d 


The  results  of  the  testing  process; 


e. 


The  status  of  contingency  planning  efforts;  and 


f. 


The  status  of  the  ongoing  assessment  of  customer  risk. 


IV.  SANCTIONS 

1 .  All  licensees  shall  be  in  compliance  with  these  standards  at  all  times.  In  addition,  all 
licensees  must  respond  to  requests  by  the  Division  for  information  regarding  Year  2000 
compliance.  Failure  to  review,  renovate  and  test  internal  and  external  mission  critical 
systems;  or  to  develop  and  implement  business  resumption  or  remediation  contingency 
plans;  or  to  appropriately  identify  customer  risks;  or  to  respond  to  requests  for 
information  in  accordance  with  this  bulletin  shall  establish  that  a  licensee  does  not  possess 
the  financial  responsibility,  character,  reputation,  integrity,  and  general  fitness  such  as  to 
warrant  the  belief  that  the  business  will  operate  honestly,  fairly,  soundly,  and  efficiently  in 
the  public  interest. 

2.  The  Division,  in  its  discretion,  may  impose  any  or  all  of  the  sanctions  of  section  IV(4), 
under  the  following  circumstances: 

a.  If  a  report  of  examination  conducted  by  the  Division  determines  that  a  licensee  is 
not  in  compliance  with  Year  2000  compliance  standards  by  virtue  of  receiving  a 
"Needs  to  improve"  or  "Unsatisfactory"  rating  during  or  after  the  mission  critical 
systems  testing  stage; 

b.  The  licensee  fails  to  take  immediate  and  satisfactory  corrective  action  as  directed  by 
the  Division;  or 

c.  The  licensee  is  not  in  compliance  with  the  guidelines  above;  or 

d.  The  licensee  fails  to  respond  to  requests  for  information  relative  to  Year  2000 
compliance. 

3.  Corrective  action.  Failure  to  take  satisfactory  corrective  action  shall  include,  but  is  not 
limited  to,  failing  to  submit  an  acceptable  corrective  action  plan  or  submitting  a  corrective 
plan  that  is  rejected  or  deemed  unacceptable  by  the  Division. 

4.  Failure  to  comply  with  section  IV(l-3)  shall  constitute  grounds  for  the  imposition  of  the 
following  sanctions,  in  accordance  with  applicable  licensing  statutes  and  G.L.  c.  30A: 

a.  license  revocation; 

b.  license  suspension; 

c.  license  non  renewal;  or 
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d.  the  issuance  of  an  order  to  cease  and  desist. 
V.  SEVERABILITY 

If  any  provision  of  this  policy  statement,  or  the  application  thereof  to  any  person  or  circumstance 
is  for  any  reason  held  to  be  invalid,  the  remainder  of  this  statement  and  the  application  of  such 
provisions  to  other  persons  or  circumstances  shall  not  be  affected  thereby. 

VI.  Sunset 

This  policy  statement  of  the  Division  of  Banks  shall  expire  on  December  3 1 ,  2001 
VH.  AUTHORITY 

G.L.  c.  93,  ss.  24-28;  G.L.  c.  140,  ss.  96-114A;  G.L.  c.  167F,  s.  4;  G.L.  c.  169;  G.L.  c.  169A; 
G.L.  c.  255B;  G.L.  c.  255C;  G.L.  c.  255D;  and  G  L.  C.  255E. 
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Year  2000  Awareness 


The  Department  of  Environmental  Protection  is  responsible  for 
ensuring  clean  air  and  water,  the  safe  management  and  disposal  of 
solid  and  hazardous  wastes,  the  timely  cleanup  of  hazardous  waste 
sites  and  spills,  and  the  preservation  of  wetlands  and  coastal 
resources.  In  carrying  out  this  mission,  DEP  promotes  pollution 
prevention;  permits/certifies  facilities  and  activities;  inspects  sites  and 
facilities;  initiates  enforcement  actions;  implements  resource 
protection  strategies;  provides  emergency  response  to  spills;  oversees 
cleanup  of  sites;  conducts  research;  and  provides  municipalities, 
citizens,  and  regulated  businesses  with  information  and  assistance. 

The  purposes  of  this  notice  are  to  raise  awareness  of  the  Year  2000 
(Y2k)  problem  among  the  regulated  community  and  to  encourage  it  to 
take  immediate  action  to  assess  and  correct  related  problems. 
Regulated  entities  are  responsible  to  anticipate  and  eliminate  any  Year 
2000  problems  that  may  impede  their  compliance  with  environmental 
laws  and  regulations.  DEP  has  issued  a  Y2K  Enforcement  Policy 
Statement  to  clarify  expectations,  (below). 

YEAR  2000  PROBLEM 

In  the  past  20  to  30  years,  many  computer  systems  were  designed  so 
that  date  fields  utilize  two  digits  to  designate  the  year  At  the  turn  of 
the  millennium,  these  systems  will  incorrectly  interpret  the  year  "00" 
unless  they  are  redesigned  to  incorporate  four-digit  fields  to  designate 
the  century.  In  addition,  some  programs  and  data  files  may  have  used 
the  date  9/9/99  as  a  "dummy"  placeholder  to  indicate  program 
termination,  expiration  dates  or  file  erasure  dates.  Also,  the  year  2000 
is  a  leap  year,  and  some  systems  will  produce  wrong  day-of-the-week 
representations  after  February  29,  2000. 

The  Year  2000  problem  affects  all  organizations  that  use  computer 
systems  in  the  course  of  their  business.  This  includes  governments  at 
all  levels  -  local,  state  and  federal  -  especially  because  of  their 
dependence  on  many  older  systems  that  have  been  successfully 
operating  with  only  minor  modifications  for  10  to  30  years.  The  issue 
is  not  limited  to  mainframes,  mid-range  systems  and  PCs:  PBX 
systems,  Fax  machines,  VCRs,  automated  alarms,  doors  and  elevators, 
laboratory,  monitoring,  and  field  equipment  may  also  be  affected.  The 
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issue  applies  to  all  programming  languages  and  operating  systems  as 
well  as  spreadsheets,  personal  database  applications,  ad-hoc  queries 
and  report  requests. 

YEAR  2000  CORRECTION  APPROACH 

Regulated  entities  are  encouraged  to  follow  a  systematic  approach  to 
assessing  and  correcting  the  Year  2000  problem.  A  sample  of  the 
Commonwealth's  Year  2000  strategy  which  encompasses  five  phases, 
is  shown  below: 

•  Awareness:  Effectively  communicate  with  staff  to  ensure  that 
they  understand  the  Year  2000  problem,  participate  in  all  phases 
of  assessment  and  remediation,  and  prepare  contingency  plans. 

•  Inventory:  Conduct  a  comprehensive  inventory  of  the  various 
systems,  hardware,  firmware,  off-the-shelf  software,  and 
equipment  that  contains  embedded  chips/clocks  in  the 
organization. 

•  Assessment  and  Planning:  Decide  how  to  achieve  agency 
compliance  by  reviewing  applications/systems  with  respect  to 
business  needs  and  long-term  agency  objectives;  determining 
whether  to  retire,  replace,  redevelop,  or  remediate  each 
application,  system,  or  piece  of  equipment;  establishing 
priorities;  and  preparing  test  plans. 

•  Conversion/Replacement:  Implement  solutions  by  purchasing, 
upgrading,  or  repairing  systems,  products  or  equipment; 
preparing  final  test  plans  and  a  test  environment;  and 
reevaluating  the  assessment  plan. 

•  Validation  and  Deployment:  Carry  out  tests;  document  results 
in  detailed  reports;  re-deploy  systems  and/or  equipment;  train 
end  users  in  use  of  features  modified  because  of  Y2K  changes. 

ADDITIONAL  INFORMATION 

Numerous  Internet  web  sites  are  available  to  provide  you  with 
additional  information.  A  sampling  follows: 

•  Massachusetts  Information  Technology  Division's  Year  2000 
website  at  http://www.state.ma.us/v2k/  provides  two 
documents  that  explain  how  to  get  started  in  meeting  the  Y2K 
challenge,  (Meeting  the  Challenge,  I  and  II)  and  a  sample  Y2K 
project  plan  that  can  be  downloaded  and  customized  to  track 
your  Y2K  project.  In  addition,  a  white  paper  concerning  Y2K 
issues  for  cities,  towns,  and  other  local  governmental  entities 
has  been  posted. 

•  U.S.  Environmental  Protection  Agency's  website  at 
http://www.epa.gov/year2000/  includes  a  Year  2000  guidance 
document  that  provides  assistance  in  preparing  Y2K  strategy 


http://www.magnet.state.ma.us/dep/y2k.htm 


1/22/99 


MA  DEP  Year  2000  Awareness 


Page  3  of  4 


documents  and  describes  EPAs  efforts. 

•  Public  Technology  Inc.  maintains  a  Year  2000  website  at 
http://www.pti.nw.dc.us/membership/v2k/.  This  site  was 
prepared  in  conjunction  with  the  National  League  of  Cities,  the 
National  Association  of  Counties,  and  the  International 
City/County  Management  Association  to  build  awareness  about 
the  Y2K  problem,  identify  solutions  and  resources  to  solve  the 
problem,  and  promote  contingency  planning  for  those  that  may 
not  be  ready  by  December  31,  1999. 

This  message  was  prepared  for  informational  purposes  only. 
Information  provided  does  not  represent  government,  business,  legal, 
or  other  advice  related  to  the  Year  2000  problem. 

YEAR  2000  ENFORCEMENT  POLICY  STATEMENT 

The  Massachusetts  Department  of  Environmental  Protection  ("DEP") 
is  responsible  for  ensuring  compliance  with  environmental  laws  and 
regulations. 

Regulated  entities  are  responsible  for  taking  whatever  steps  are 
necessary  to  ensure  continued  full  compliance  with  environmental 
laws  and  regulations.  This  responsibility  involves  identifying  and 
remediating  any  Year  2000  ("Y2K")  problems  that  threaten  full 
compliance,  and  includes  a  full  Y2K  issues  assessment  of  possible 
vulnerabilities  of  data  systems,  monitoring  and  operating  systems  and 
embedded  computer  chips  that  are  relied  upon  for  business  operation 
or  as  part  of  the  data  gathering  and  reporting  process. 

The  Y2K  problem  is  receiving  substantial  attention  in  the  media.  In 
addition,  DEP,  along  with  the  U.S.  Environmental  Protection  Agency 
and  numerous  local  authorities  and  professional  organizations,  is 
engaged  in  a  public  outreach  effort  to  raise  the  awareness  of  regulated 
entities  about  the  Y2K  problem,  and  to  encourage  them  to  take 
immediate  action  to  assess  and  correct  related  problems. 

Accordingly,  DEP  will  not  accept  Y2K  excuses  as  constituting  force 
majeure  or  other  defense  against  enforcement  for  noncompliance.  This 
applies  both  to  Y2K  problems  arising  from  a  regulated  entity's  own 
equipment  and  facilities  as  well  as  to  problems  stemming  from  a 
vendor's  facility  or  equipment.  Although  failure  to  be  Y2K  compliant 
is  not  itself  a  violation,  DEP  will  consider  failure  to  comply  with 
environmental  requirements  because  of  Y2K  problems  to  be 
violations,  and  may  enforce  against  those  violations. 


Contact:  Victoria.Phillips@state.ma,us 
[MA  DEP  Home]  [Search] 
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Massachusetts 


60  Temple  Place,  Boston,  MA  02111 
(617)  426-7272  or  800  882-1498 
Facsimile  (617)  426-9546 


Interlocal  Insurance  Association 


January  19,  1999 


Mr.  Val  Asbedian 

Director,  Strategic  Planning  Group 

Commonwealth  of  Massachusetts 

Information  Technology  Division 

One  Ashburton  Place 

Room  801 

Boston,  MA  02108 

Dear  Val: 

On  behalf  of  the  MIJA  staff,  thank  you  very  much  for  coordinating  the  Y2K  workshop  at 
the  MMA  annual  meeting  last  Friday. 

The  information  you  presented  was  both  abundant  and  accessible  and  the  participants  went 
away  enriched  with  information  and  direction. 

We  were  pleased  with  the  large  turnout  for  the  workshop  and  feel  grateful  for  the  high  level 
of  expertise  you  and  your  fellow  panelists  embody.  Your  suggestion  that  David  and  Jerry 
round  out  the  panel  was  an  excellent  one.  You  make  a  very  effective  team! 

On  a  personal  note,  I  truly  appreciate  your  supportive  and  relaxed  manner  during  our 
preparations.  You  are  a  pleasure  to  work  with! 

If  you  would  like  additional  copies  of  the  Y2K  Survival  kit,  please  let  me  know.  I  do  plan 
to  send  a  copy  to  Governor  Cellucci's  office  as  you  suggested. 

I  hope  to  have  the  opportunity  to  work  with  you  again  in  the  months  before  and  after 
January  1,  2000! 


Sincerely, 


Membership  Services  Coordinator 


MJJA 


An  Interlocal  Service  of  the  Massachusetts  Municipal  Association 
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November  13, 1998 


Mr.  Val  Asbedian 

Director  of  Strategic  Planning 

Commonwealth  of  Massachusetts 

Information  Technology  Division 

1  Ashburton  Place 

Boston,  MA  02108 

Dear  Val, 

On  behalf  of  the  North  Central  Massachusetts  Chamber  of  Commerce,  I  want  to 
thank  you  for  taking  the  time  out  of  your  busy  schedule  to  address  our  audience  at  our 
October  breakfast  program.  Your  discussion  on  Y2K  was  both  interesting  and 
informative.  All  comments  from  the  attendees  were  very  positive  and,  as  you  could  tell 
by  the  attendance  and  questions,  was  a  topic  everyone  was  looking  forward  to.  My  only 
regret  is  that  we  did  not  have  more  time. 

If  I  may  ever  be  of  any  assistance  to  you,  please  do  not  hesitate  to  contact  me. 

Sincerely, 


Nancy  A.  Maynard 
Program  Manager 


110  Erdman  Way 
Leominster,  MA  01453 


NORTH  (/CENTRAL 


MASSACHUSETTS 

CHAMBER  OF  COMMERCE 


Tel.  (9  7  8)  8  4  0-0  7  3  2 
FAX  (978)840-4896 


ROBERT  F.  STALNAKER 
EXECUTIVE  DIRECTOR 


The  Commonwealth  of  Massachusetts 

Public  Employee  Retirement  Administration  Commission 
5  Middlesex  Avenue,  3rd  Floor 
Somerville,  MA  02145 
(617)  666-4446 
Fax:  (61 7)  628-4002     TTY:  (61 7)  591  -891 7 
www.state.ma.us/PERAC 


October  22,  1998 


commission  members 

ELIZABETH  E.  LAING,  Chair 
A.  JOSEPH  DeNUCCI,  Vice  Chair 
JOHN  R.  ABBOTT 
CHARLES  D.  BAKER 
KENNETH  J.  DONNELLY 
DONALD  R.  MARQUIS 
DIANNE  HYDE  RUSSELL 


Val  Asbedian 

ITD,  Dir.  of  Strategic  Planning 
One  Ashburton  Place,  Room  801 
Boston,  MA  02108 
Dear  Val: 


On  behalf  of  PERAC  and  MACRS  I  would  like  express  our  appreciation  for  your  "Year 
2000"  presentation  at  the  recent  MACRS  Conference.  The  material  was  informative  and 
enlightening  and  will  help  to  give  this  topic  the  awareness  that  is  needed. 

7 

It  really  is  great  to  be  able  to  call  on  the  expertise  and  resources  available  at  the 
Information  Technology  Division. 


Thanks  again  for  your  cooperation 


/ 


Sincerely, 


James  M.  Lawson,  Jr. 
IS  Manager 


cc:  Luis  Gutierrez,  CIO  -  ITD 

Robert  Stalnaker,  Exec.  Dir.  -  PERAC 
Ann  O'Brien,  Assist.  Exec.  Dir.  -  PERAC 
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MASSACHUSETTS  FOOD  ASSOCIATION 


: —  4  - 

STEPHEN  B.  LINCOLN 

Gerelick  Farms 
OFFICERS 

ViCt  CAUIW 

BRIAN  PUANOWSKI 
Shews  Supermarkets 

Treasurer 

RICHARD  HAG0P1AN 
Ro-Jack-s  Supermarkets 

DIRECTORS 
ROBERT  ANNAND 
Rocne  Brothers  Supermarket! 

BRUCE  APRIL 
Apnn  Markat 

SUREN  AVEDISIAN 

On\ni  roods 
KEVIN  BARRETT 
DeMBe  4  Touche 
DAVID  BRUNELLE 
Big  Y  Supermarkets 
RALPH  CROWLEY  JR. 
Polar  Peveragss 
SAM  CUCINOTTA 
UiU  Suparmarkals 

•  CHARLES  D" AMOUR 
Big  Y  Foods 

•JOHN  ANDREW  DeJESUS 
Foodmaster  Supermarkets 
DARRELL  DeLONG 
Marker!  Food  Entarprtae*  N.E. 
TIMOTHY  DESMOND 
Ocean  Spray  Cranberries 
JAY  DHGER0N1M0 
Victory  Supermarkets 
JACK  DONELAN 
Doneiant  Supermarkets 


President 

CHRISTOPHER  FLYNN 


31  MILK  STREET,  SUITE  518 


BOSTON,  MASSACHUSETTS  02109 


ERIC  DORNE 
*  1  P  FOOOMART 


WILLIAM  DYNAN 
Windsor  Marketing 
JERRY  EDEL 
Tropicana  Products 
KENNETH  G.  FERRERA 
James  Ferrers  *  Sorts 
GEORGE  GANZENMULLER 
Pazrowr  Mew  England 

•"OFFREY  HARPER 
Markets 
H  HINDS 
r 


BOB  HOGAN 
imerstate  Brsnds 

WILLIAM  HOLMES 
Stop  &  Shop  Companies 
PAUL  KARAPANOS 
Park  "N  Shop  Supermarkets 
DENIS  KEAVENY 
Cains  Foods 

JULIEN  LaCOURSE 
Demoulasa  Market  Basket 

JACK  LAURENDEAU 
MAJ  Alper,  Inc. 

ALBERT  LEES  III 
Lees  Supermarket 

DOREEN  LEWIS 
Hannaford  Brothers 
TERRY  MARKS 
Coca-Cola  Bottling  ol  N  E. 
STEVE  NUDSON 
Supervalu 

HARRY  "CHIP-  O'HARE 
Johnson  0*Hare 

PAT  OPPEDISANO 
Boston  Retail  Grocers 

•  VERNE  POWELL 
Shanrs  Supermarkets 

JOHN  PUCCIO 
AdUfe  Marketing 

DOUG  RAUCH 
Trader  Joe's 
LARRY  RENCKEN 
Welch's 

JOHN  ROCHE 
H^niand  Foods 
CHARLES  SAGE 
Sage's 

DAVID  SCARBO 
H  P  Hood.  Inc. 

GEORGE  SEMANIE 
CAS  Wholes  ale  Grocers,  Inc. 

MICHAEL  SLEEPER 
Imperial  Distributors 
PAUL  SNELL 
Pepai  Cole 
DAN  SULLIVAN 
Buckley  Thome  Messina  Co. 
MICHAEL  TOBIA 
OMR 

WILLIAM  TRUCCHI 
Tmeehrs  Supermarkets 

GINNY  WILLIAMS 
Pkleoury  Co. 
w^TWYAJT 

W ZK YOUNG 

~s«  Foods 
DONALD  ZALATAN 
Pnce  Chooper 


($17)  542-3085 
FAX:  (617)  542-3505 
Email:  mafood@aol.com 


October  15,  1998 

Mr.  Val  Asbedian 
Director,  Strategic  Planning  Group 
One  Ashburton  Place,  Room  801 
Boston,  MA  02108 

Dear  Mr.  Asbedian, 

I  would  like  to  thank  you  for  taking  the  time  out  of  your  busy 
schedule  to  attend  our  October  1st  Board  of  Directors  meeting  as  our  guest 
speaker. 

From  the  comments  we  received,  those  in  attendance  found  your 
presentation  on  Y2K  compliance  both  informative  and  interesting.  The 
information  you  supplied  and  discussed  is  most  appreciated. 

Please  do  not  hesitate  to  contact  my  office  if  you  wish  to  share  any 
further  information  or  if  we  can  be  of  any  assistance. 


Sincerely, 


stopher  P.  Flynn 


•ti-omcK 


i 


i 


MASSACHUSETTS  WATER  RESOURCES  AUTHORITY 
Charlestown  Navy  Yard 
100  First  Avenue 
Boston,  Massachusetts  02129 


Telephone  (617)  242-6000 
Facsimile.  (617)  241-6070 


October  8,  1998 

Mr.  Val  Asbedian 

Director  of  Strategic  Planning 

Commonwealth  of  Massachusetts 

Information  Technology  Division 

One  Ashburton  Place 

Boston,  MA 

Dear  Val, 

Thank  you  for  your  participation  in  the  Massachusetts  Water  Resources  Authority's  (MWRA's) 
Year  2000  Program  Community  Forum  (Mass Water  2000).  Your  participation  and  presentation 
was  very  helpful  in  providing  the  communities  with  the  necessary  background  and  information 
that  is  necessary  to  address  the  Year  2000  problem.  The  response  from  those  in  attendance  was 
very  positive.  Participants  are  looking  forward  to  the  next  session. 

The  MWRA  and  MWRA  Advisory  Board  will  continue  to  conduct  quarterly  forums  with  its 
member  communities  in  an  effort  to  continue  to  share  information  regarding  our  Year  2000 
plans,  to  foster  the  exchange  of  information,  and  if  necessary  coordinate  efforts  amongst  agencies 
such  as  yours.  We  look  forward  to  your  participation  as  we  continue  our  community  outreach. 


Sincerely, 


Robert  B.  Regan,  Y2K  Program  Manager 


^  Printed  on  100%  Recycled  Paper 
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By 

Commonwealth  of  Massachusetts 
Year  2000  Program  Management  Office 
February  3, 1999 

1  Background 

In  June  1997,  ITD's  Strategic  Planning  Group  (SPG)  established  the  Year  2000  Program  Management  Office 
(Y2K  PMO)  to  coordinate  the  Commonwealth's  Year  2000  effort.  The  purpose  of  the  Y2K  PMO  is  to: 

•  Ensure  accurate  monitoring  of  the  Commonwealth's  progress  in  meeting  the  Year  2000  challenge; 

•  Identify  risk  areas  and  risk  mitigation  activities; 

•  Disseminate  lessons  learned  to  state  agencies;  and, 

•  Serve  as  a  Year  2000  resource  to  state  agencies  and  departments  in  the  three  government  branches. 

Executive  Order  #408,  issued  on  December  14, 1998,  requires  that  the  head  of  each  state  agency  shall  appoint 
a  senior  official  to  oversee  and  coordinate  the  Year  2000  compliance  and  contingency  planning  activities  of 
each  agency  under  their  supervision. 

The  PMO  uses  an  interview  process  to  monitor  the  status  of  the  Year  2000  projects  being  performed  by  the 
agencies  in  the  Commonwealth.  This  interview  process  includes  a  determination  of  the  approach  being  used 
by  an  agency  to  identify  its  exposure  to  the  Year  2000  problem  and  to  achieve  Year  2000  compliance.  The 
PMO  monitors  agencies  on  a  quarterly  cycle. 

In  addition,  agencies  are  asked  to  identify  their  mission  critical  and  essential  systems  and  to  provide 
information  on  the  strategy  for  and  progress  in  making  these  systems  compliant. 

Mission  critical  systems  are  those: 

•  Which  directly  impact  the  health,  safety,  or  livelihood  of  Commonwealth  citizens, 

•  Which  directly  impact  revenue  to  the  state,  or 

•  Whose  loss  would  severely  jeopardize  agency  delivery  of  services . 

Essential  systems  are  those  whose  loss  would  cause  a  disruption  of  some  agency  services  but  the  agency 
could  still  deliver  primary  services. 

Most  agencies  also  have  a  third  category  of  systems,  "other  required",  which  affect  workflow  in  the  agency  but 
whose  loss  would  not  significantly  impair  delivery  of  services.  Agencies  are  expected  to  include  all  systems  in 
their  Year  2000  projects,  but  the  PMO  is  only  monitoring  the  status  of  mission  critical  and  essential  systems. 

This  report  compiles  information  obtained  during  the  Oct.  -  Dec.  1998  quarter  to  provide  updated  information  on 
all  agencies  regarding  achieving  compliance  in  accordance  with  the  Commonwealth  target  dates  for 
redeployment: 

•  January  31 , 1 999  for  mission  critical  systems  and 

•  May  31 , 1 999  for  essential  systems. 


The  following  definitions  of  Agency  and  System  Schedule  Status  are  applied  in  the  PMO  reports: 


Agency 
Schedule 
Status 

System 
Schedule 
Status 

Definition 

Green 

Low 

Has  met  or  is  expected  to  meet  Commonwealth  Target  Dates 

Red 

High 

Scheduled  to  miss  at  least  one  Commonwealth  target  date 

Yellow 

Medium 

Latest  reported  schedule  meets  the  Commonwealth  Target  Date ,  but 
significant  factors  which  could  result  in  schedule  slippage  also  reported 
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To  date,  no  agency  has  reported  that  they  will  be  unable  to  deliver  uninterrupted  essential  services.  It  should  be 
noted  that  remediation  projects  for  14  (5%)  of  the  Commonwealth's  297  Mission  Critical  Systems  are  currently 
scheduled  for  completion  after  June  30,  1999,  and  another  13  (4%)  currently  have  no  committed  Scheduled 
Deployment  Date*. 

2    Summary  of  Agency  Status  for  the  Quarter 
2.1  Interviews 

The  Y2K  PMO  is  currently  monitoring  Year  2000  compliance  efforts  for  1 70  agencies  in  the  Commonwealth. 
The  changes  reflect  one  agency  added  by  the  PMO  to  Transportation  and  Construction,  one  agency  added 
within  General  Court,  one  agency  dropped  from  Public  Safety,  and  one  reclassified  from  Economic 
Development  to  an  Independent  Agency.  The  agencies  are  classified  as  shown  in  Table  1 . 


Table  1.  Agencies  Interviewed  for  Oct.  -  Dec.  1998 


Aaencv  Tvoe 

#  of  Agencies 

Oct  -  Dec.  98 



#  of  Agencies 
JuL -Sep.  98 

A&F 

20 

20 

Constitutional  Offices 

6 

6 

Consumer  Affairs 

10 

10 

Economic  Development 

5 

6 

Education 

1 

1 

Elder  Affairs 

1 

1 

Environmental  Affairs 

7 

7 

Executive  Offices 

3 

3 

General  Court 

4 

3 

Health  and  Human  Services 

16 

16 

Higher  Education 

32 

32 

Housing 

2 

2 

Independent  Agencies 

24 

23 

Judiciary 

5 

5 

Labor  Development 

9 

9 

Public  Safety 

21 

22 

Transportation  &  Construction 

4 

3 

Total 

170 

169 

For  the  current  quarter,  the  Y2K  PMO  interviewed  all  agencies  in  this  list.  Interviewers  conducted  interviews  by 
phone  or  in  person.  Evaluation  criteria  used  for  the  current  quarter  were  similar  to  those  used  for  the  Jul.  - 
Sep.  98  quarter. 


Absence  of  a  committed  scheduled  deployment  date  typically  was  reported  as  being  due  to  uncertainties  about  funding,  staffing  or 
dependence  on  an  external  partner  for  support  or  cooperation  in  remediation  or  testing. 
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Agency  Status 

Summary  statistics  for  the  agency  Year  2000  projects  are  shown  in  Table  2. 


Table  2.  Agency  Y2K  Project  Status  Summary  for  Oct.  -  Dec.  1998 


#  of  Agencies 
Oct  -  Dec.  98 

#  of  Agencies 
Jul. -Sep.  98 

Status 

Green 

107 

123 

Yellow 

21 

14 

Red 

42 

31 

Agencies  to  be  interviewed 

1 

Total  Number  of  Agencies  Being  Tracked 

170 

169 

The  data  indicates  a  number  of  changes  in  status  of  Year  2000  compliance  efforts  for  the  agencies  from  the 
status  reported  in  Jul.  -  Sep.  98.  The  changes  are  summarized  in  Table  3. 


Table  3.  Change  in  Agency  and  Systems  Y2K  Project  Status  from  Previous  Quarter 


Change 

#  Agencies 

ff  systems 

Improved 

8 

43 

No  Change 

133 

199 

Slipped 

29 

33 

No  3Q98  Data 

241 

Total 

1  (u 

51b 

Note:  241  systems  either  belonged  to  "Green"  status  agencies  which  were  not  reviewed  in  the  Jul.  -  Sep.  98 
period,  or  were  newly-reported  systems. 

The  table  indicates  that  while  8  agencies'  schedules  improved  in  the  quarter,  29  agencies'  schedules  slipped. 
However,  15  of  the  29  went  from  Green  to  Yellow  status,  indicating  that  their  current  schedule  still  indicates 
completion  on  time,  but  that  there  are  circumstances  which  may  result  in  some  of  these  agencies'  failing  to 
make  schedule,  while  the  remainder  will  likely  still  complete  on  time.  Such  slippage  is  to  be  expected  due  to  the 
technical  nature  and  complexity  of  Year  2000  projects. 


2.2    System  Status 

The  170  agencies  that  the  PMO  is  tracking  have  reported  297  mission  critical  systems  and  219  essential 
systems.  Table  4  gives  the  PMO's  assessment  of  the  schedule  status  for  these  systems  and  indicates  that 
between  57%  and  69%  of  Mission  Critical  Systems  were  likely  to  to  meet  the  Commonwealth  target  compliance 
schedule  of  January  31 , 1 999  at  the  time  of  interviewing.  Between  85%  and  90%  of  Essential  Systems  were 
likely  to  meet  the  Commonwealth  target  compliance  schedule  of  May  31 , 1999  at  the  time  of  interviewing.  The 
difference  in  both  cases  is  represented  by  the  percentage  of  systems  with  a  Yellow  Status.  If  some  of  these 
systems  are  deployed  as  scheduled,  the  percentage  rises  towards  the  maximum. 
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Table  4.  Summary  of  Schedule  Status  for  Systems 


Mission  Critical  Systems 

Essential  Systems 

L/ 1*  I .  —  UcL . 

JUL  Ocp. 

f~)r*t   npr 

Jail  _  5%pn 

Schedule*  Status 

1  330 

1  Q9R 

1  w7D 

1998 

1998 

1  »/ 

Minh 

nign 

92 

6/ 

IVIcUIUI  1  1 

37 

1  1 

1 U 

y 

LUW 

I  DO 

o  / 

Assumed  Low* 

91 

73 

Insufficient  Data** 

10 

1 

Total 

297 

266 

219 

191 

Low  (likely) 

57% 

85% 

■  ■     ■ .  ■ 

Medium  (possible) 

12% 

5% 

Maximum  On  Time 

69% 

90% 

*    Agency  was  not  interviewed  in  prior  quarter.  Low  status  was  assumed  from  status 

determined  for  previous  quarter. 
**    Required  agency  interview  or  additional  information. 


2.3    Increase  in  Number  of  Mission  Critical  and  Essential  Systems  Tracked 

The  information  in  Table  4  indicates  that  the  number  of  mission  critical  and  essential  systems  being  reported  to 
the  PMO  has  increased.  This  increase  was  anticipated  in  the  Jul.  -  Sep.  98  report  due  to  the  identification  of 
Mission-Critical  applications  which  surfaced  during  desktop  compliance  and  non-IT  ("embedded")  systems 
assessment  efforts.  In  addition,  several  agencies  reorganized  their  remediation  projects,  or  reported  additional 
systems  as  a  result  of  responding  to  the  Survey  from  the  Office  of  the  State  Auditor  and/or  the  Agency 
Statement  of  Compliance  Status  issued  by  the  PMO. 


2.4    System  Scheduled  Deployment  Dates 


Scheduled  deployment  dates  of  systems  are  shown  in  Graph  1 .  Systems  with  no  currently  committed 
scheduled  deployment  date  were  listed  as  TBD  . 


Graph  1.  System  Scheduled  Deployment  Dates 
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TBD:  Absence  of  a  committed  scheduled  deployment  date  typically  was  reported  as  being  due  to  uncertainties  about  funding,  staffing  or 
dependence  on  an  external  partner  for  support  or  cooperation  in  remediation  or  testing. 
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2.5    System  Future  Date  Testing  Plans 

Testing  in  an  environment  to  simulate  operation  during  the  Year  2000  ("Future  Date  Testing")  is  recommended 
of  all  systems.  It  should  be  noted  that  some  environments  (on  IBM  mainframes,  for  example)  have  not  been 
available  for  such  testing.  In  accordance  with  the  Year  2000  Compliance  and  Validation  Standards  of  July  31 , 
1998,  Future  Date  Testing  must  be  implemented  for  every  agency's  mission  critical  systems  in  order  to  address 
the  possibility  that  errors  may  have  been  overlooked  or  introduced  during  remediation  and  ordinary 
maintenance  testing. 


2.6    Commonwealth-Critical  Agencies 

Chapter  289,  Section  360  of  the  Acts  of  1998  directs  the  Information  Technology  Division  and  the  Chief 
Information  Officer  of  the  Commonwealth  to  coordinate  and  oversee  the  Year  2000  compliance  efforts  of  the 
executive  departments.  The  CIO  of  the  Commonwealth,  in  conjunction  with  the  Secretary  of  Administration  & 
Finance,  will  identify  those  agencies  whose  uninterrupted  service  delivery  is  considered  of  extreme  importance 
to  the  hearth,  safety  and  livelihood  of  the  citizens  of  the  Commonwealth  of  Massachusetts,  or  to  agencies  who 
provide  such  services.  These  agencies  will  be  designated  as  Commonwealth-Critical  Agencies. 

All  Commonwealth-Critical  Agencies  must  perform  Independent  Verification  and  Validation  work  for  Mission 
Critical  systems,  as  stipulated  in  the  Year  2000  Compliance  and  Validation  Standards  published  in  August 
1998.IV&V  allows  for  an  independent  verification  of  the  remediated  code  and  testing  procedures,  thus  reducing 
the  likelihood  of  a  system  failure.  Several  Federal  agencies  have  already  mandated  that  their  state  counterparts 
undertake  IV&V  in  order  to  reduce  the  possibility  of  large-scale  processing  problems. 

Contingency  Plans  are  recommended  for  all  Mission  Critical  systems,  but  are  required  (per  the  Executive  Order 
#408)  for  all  Executive  Branch  agency  systems  whose  scheduled  deployment  date  is  after  June  30,  1999,  and 
for  all  Mission  Critical  systems  belonging  to  Commonwealth-Critical  Agencies. 

It  is  the  responsibility  of  Commonwealth-Critical  Agencies  to  complete  Business  Continuity  Planning  for  those 
vital  service  operations  which  might  be  affected  by  a  software  application  disruption  or  any  other  cause,  such  as 
failure  of  external  interfaces,  business  partners,  etc. 


2.7    Emergency  Preparedness 

The  PMO  has  met  with  and  continues  to  work  with  FEMA  and  MEMA,  the  Massachusetts  Emergency 
Management  Agency,  to  draw  up  emergency  preparedness  plans  for  use  in  the  event  that  unforeseen  problems 
occur  which  might  otherwise  threaten  to  disrupt  the  normal  delivery  of  emergency  services,  traffic  control,  etc. 
FEMA  coordinates  regional  planning  and  coordination,  while  MEMA  coordinates  planning  and  coordination  for 
the  Commonwealth  of  Massachusetts. 
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2.8    LAN  Compliance 

The  Executive  Branch  was  directed  by  the  CIO  of  the  Commonwealth  to  achieve  compliance  for  all  LAN's  by 
December  31,  1998.  While  this  has  spurred  activity  in  those  agencies,  others  are  delaying  plans  until  June  of 
1999.  Graph  2  shows  the  percent  of  agencies  reaching  LAN  Compliance  by  period. 

Graph  2.  LAN  Compliance  Progress  by  Period  Ending  Date 
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2.9    PC  Compliance 

The  progress  for  Desktop  PC's  and  software  compliance  is  shown  in  Graph  3.  Since  a  statewide  contract  has 
been  established  with  Platinum  Software,  a  tool  suite  for  remediating  desktop  software  assets  is  now  readily 
available  at  advantageous  pricing. 

In  addition,  the  PMO  has  provided  workshops  for  agencies  to  assist  in  understanding  how  PC  hardware  and 
software  can  be  tested  and  remediated.  This  material  is  also  made  available  on  the  PMO  website. 

Graph  3.  Percentage  of  PC's  Compliant  Today 
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TBD:  Absence  of  a  committed  scheduled  deployment  date  typically  was  reported  as  being  due  to  uncertainties  about  funding,  staffing  or 
dependence  on  an  external  partner  for  support  or  cooperation  in  remediation  or  testing. 
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2.10  Telephone  System  Compliance 

Agencies'  success  in  achieving  compliance  with  telephone  systems  has  been  occurring  at  a  slow  pace.  This  is 
partially  attributed  to  the  complexity  of  some  systems,  the  lack  of  agency  understanding  on  how  to  approach  the 
equipment  and  vendors,  and  lack  of  available  vendor  information  regarding  their  systems'  Y2K  compliance. 

To-  help  speed  the  process  of  telephone  system  compliance,  the  PMO  has  been  working  closely  with  the  ITD 
CSB  organization  to  develop  solutions  to  the  problem.  CSB  has  contacted  telephone  system  equipment  and 
service  providers  in  order  to  assemble  information  and  tools  to  be  used  by  Agencies  in  achieving  Y2K 
compliance.  The  tools  include  a  process  methodology,  a  vendor  contact  listing,  a  presentation  of  information  at 
the  Y2K  User  Group  meeting  and  posting  of  information  on  the  Commonwealth's  Y2K  Web  page. 


Graph  4.  Telephone  Compliance  Progress  by  Period 
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3    General  Comments 


A.  Agency  Schedule  Slippage.  The  information  in  Table  3  indicates  that  agency  projects  are  becoming  more 
stable.  However,  schedule  slippage  from  quarter  to  quarter  should  now  become  the  focus  of  additional 
management  attention  to  ensure  that  any  persistent  project  issues  are  resolved.  The  status  of  these 
agencies  will  become  more  difficult  to  correct  as  the  remaining  time  diminishes;  it  is  imperative  that  steps  be 
taken  soon  to  correct  the  situation. 

B.  Systems  Schedule  Status.  As  shown  in  Table  4,  the  number  of  Red  mission  critical  systems  ( 92)  has  risen 
(from  67)  and  is  too  high.  While  there  frequently  are  external  factors  which  can  cause  an  information 
technology  project  schedule  to  slip,  the  PMO  will  monitor  these  systems'  project  progress  to  ensure  that  any 
schedule  slippage  from  current  completion  dates  is  addressed,  and  that  contingency  plans  are  developed 
as  required. 

C.  Awareness.  Awareness  has  increased  significantly  in  the  past  quarter.  This  is  probably  due  to  the  number 
of  external  agencies  requesting  Y2K  information,  in  particular 

•  Executive  Order  #408,  requiring  that  the  secretary  of  each  office,  and  the  director  of  each  department 
appoint  a  senior  official  to  oversee  and  coordinate  the  compliance  and  contingency  planning  activities 
of  each  agency  within  his  or  her  secretariat  or  department. 

•  Recent  CIO  requirement  that  agencies  submit  their  initial  "Agency  Statement  of  Year  2000  Compliance 
Status"  (due  September  14, 1998)  which  requires  signatures  of  executive  management. 

•  Year  2000  survey  from  the  Office  of  the  State  Auditor  due  September  17, 1998. 

•  CIO  requirements  for  IV&V  and  contingency  planning  for  Y2K  projects. 

D.  Funding  and  Legislative  Support.  The  inclusion  of  the  Y2K  supplemental  funding  of  $20.4M  approved 
August  10, 1998  has  relieved  a  great  deal  of  potential  slippage  previously  reported  for  Y2K  projects. 
However,  this  funding  is  currently  fully  designated  and  no  longer  includes  a  reserve  for  unexpected  projects. 
An  additional  funding  request  will  be  submitted  to  the  Legislature  shortly. 

E.  Contingency  Planning.  Since  most  agencies  are  still  heavily  involved  in  remediating  their  systems,  only  a 
very  few  agencies  have  started  development  of  contingency  plans.  As  remediation  efforts  end,  or  project 
schedules  slip  enough  to  mandate  contingency  planning,  the  PMO  anticipates  the  number  of  systems  with 
Contingency  Plans  will  increase  during  the  next  quarter. 

F.  Embedded  Systems .  This  remains  an  area  of  concern,  but  agencies  having  significant  exposure  in  this 
area  have  demonstrated  good  progress  this  quarter.  Reported  experience  of  agencies  currently  tracks  with 
the  embedded  systems  industry,  and  indicates  that  only  a  small  %  of  embedded  systems  components 
have  a  date-related  problem  which  needs  to  be  analyzed  to  determine  rf  they  have  an  adverse  impact . 
While  there  are  lead  times  associated  with  contracting  external  vendors  to  service  these  items,  and  a 
significant  pace  of  remediation  must  be  established  and  maintained,  the  percentage  of  affected  assets  is 
not  as  high  as  was  originally  estimated. 

G.  Review  Process.  In  the  Oct.  -  Dec.  1 998  period,  1 07  agencies  were  rated  "Green"  for  application  software 
remediation.  While  we  will  continue  to  track  these  agencies,  the  PMO  is  going  to  undertake  a  focused 
review  of  the  Red  status  Mission  Critical  systems  in  a  monthly  basis  through  the  remainder  of  the  program. 
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Date 
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Jun-98 
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Vendor 
Com- 
pliance 

V/N 
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N/A 
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V/N 
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In 

Progress 
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In 
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Progress 

No 

In 

Progress 

Facil-ities 
Date 

Jan-99 

Oct-98 

Apr-98 

May-98 

Jul-98 

Apr-99 

Sep-98 

Apr-99 

Jan-99 

Mar-99 

Jan-98 

Phone 
Date 

Jun-98 

Aug-98 

Mar-99 

Sep-98 

Jun-98 

Jun-98 
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Systems 
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Mission 
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Change 
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No 
Change 
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Change 
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Change 
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No 
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Progress 
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N/A 

Yes 

Yes 

No 

No 

Yes 

In 

Progress 

No 

Yes 

No 

Yes 

Yes 

Facil-ities 
Date 

Feb-99 

Aug-98 

Phone 
Date 

Sep-98 

Dec-98 

Nov-98 

Aug-99 

Nov-98 

Jan-99 

Percent 
PC  Com- 
pliant 

40-60% 

80-99% 
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100% 
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Systems 
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Critical 
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Change 
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No 
Change 
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Change 
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Change 

New 
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Change 
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Change 
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Change 
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Change 
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Change 
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PMO 
Status 
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Dec.  98 
PMO 
Status 

Green 
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Green 
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Green 
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Green 

Yellow 

Red 

Red 

Green 

Red 

Agency 

Low  Level  Radio.  Waste  Mgmt  Brd 

Metropolitan  District  Commission 

Governor's  Council 

Governor's  Office 

Lt.  Governor's  Office 

House  of  Representatives 

House  Ways  and  Means 

Legislature  DP 

Senate  Computer  Division 

Comm.  for  the  Blind 

Comm.  for  the  Deaf  &  Hard  of 
Hearing 

Dept.  of  Mental  Health 

Dept.  of  Mental  Retardation 

Dept.  of  Public  Health 

Dept.  of  Social  Services 

Dept.  of  Trans.  Assistance 

Secret- 
ariat 

Environ. 

Environ. 

Exec 
Office 

Exec 
Office 

Exec 
Office 

Gen. 
Court 

Gen. 
Court 

Gen. 
Court 

Gen. 
Court 

HHS 

HHS 

HHS 
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HHS 

HHS 
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Business 
Contin- 
uity Plan 
Date 

Vendor 
Com- 
pliance 

No 

N/A 

Yes 

V/N 

No 

Yes 

Yes 

Yes 

Yes 

No 

No 

Yes 

V/N 

No 

No 

V/N 

Facilities 
Date 

Aug-98 

Jun-99 

Jan-99 

May-98 

Feb-99 

Jun-98 

Aug-98 

Jun-99 

Oct-99 

Phone 
Date 

Jul-98 

Jun-99 

Nov-98 

Nov-98 

Jan-99 

Feb-99 

Jun-99 

Aug-98 

Jun-99 

Sep-98 

Jun-99 

Jul-98 

Aug-97 

Percent 
PC  Com- 
pliant 

60-80% 

100% 

100% 

100% 

100% 

80-99% 

80-99% 

100% 

100% 

60-80% 

40-60% 

80-99% 

40-60% 

60-80% 

80-99% 

80-99% 

LAN  Date 

Jan-99 

Feb-99 

Dec-98 

Dec-98 

Nov-98 

Nov-98 

Feb-99 

Dec-98 

Dec-98 

Aug-98 

Dec-98 

Jun-99 

Jan-99 

Aug-98 

Jun-99 

Jun-98 

# 

Essential 
Systems 

CD 

CM 

# 

Mission 
Critical 
Systems 

CM 

co 

CO 

CM 

co 

CO 

CM 

CM 

co 

CM 

Change 

No 
Change 

No 
Change 

No 
Change 

No 
Change 

No 
Change 

No 
Change 

No 
Change 

No 
Change 

No 
Change 

No 
Change 

No 
Change 

No 
Change 

No 
Change 

Improved 

No 
Change 

No 
Change 

Sep.  98 
PMO 
Status 

Red 

Red 

Red 

Green 

Green 

Green 

Green 

Green 

Red 

Green 

Green 

Green 

Green 

Yellow 

Green 

Green 

Dec.  98 
PMO 
Status 

Red 

Red 

Red 

Green 

Green 

Green 

Green 

Green 

Red 

Green 

Green 

Green 

Green 

Green 

Green 

Green 

Agency 

Dept.  of  Youth  Services 

Div.  of  Health  Care  Finance 

Div.  of  Medical  Assist. 

EO  of  HHS 

Mass.  Rehabilitation  Comm. 

Office  for  Refugees  &  Immigrants 

Office  of  Child  Care  Services 

Soldiers  Home-Chelsea 

Soldiers  Home-Holyoke 

Berkshire  Community  College 

Board  of  Higher  Education 

Bridgewater  State  College 

Bristol  Comm.  College 

Bunker  Hill  Comm.  College 

Cape  Cod  Community  College 

Fitchburg  State  College 
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Business 
Contin- 
uity Plan 
Date 

Jan-99 

Jun-99 

Vendor 
Com- 
pliance 

No 

No 

No 

No 

Yes 

Yes 

V/N 

In 

Progress 

N/A 

No 

No 
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No 

No 

No 

No 
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Date 

Jun-99 
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Jun-98 

Jun-99 

Jan-99 

Jul-99 
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Mar-99 

Feb-99 

Jan-99 

Jun-98 

Feb-99 

Phone 
Date 

Dec-94 

Jan-99 

Aug-98 

Jun-98 

Sep-98 

Aug-99 

Mar-99 

Sep-99 

Jan-99 

Mar-99 

Jun-99 
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May-98 
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c  E« 
0)  o  £ 

if  O  .5 

£  2  a 

100% 

80-99% 

0-20% 

80-99% 

100% 
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40-60% 

60-80% 
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Systems 
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co 

CN 
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# 
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Change 
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No 
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Green 
Yellow 
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Red 
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Green 
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Green 

Red 

Yellow 

Green 
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Framingham  State  College 

Greenfield  Comm.  College 

Holyoke  Comm.  College 

Mass.  Bay  Comm.  College 

Mass.  College  of  Art 

Mass.  College  of  Liberal  Arts  (North 
Adams) 

Mass.  Maritime  Academy 

Massosoit  Comm.  College 

Middlesex  Comm.  College 

Mt.  Wachusett  Comm.  Coll. 

North  Shore  Comm.  College 

Northern  Essex  Comm.  College 

Quinsigamond  Comm.  College 

Roxbury  Comm.  College 

Salem  State  College 

Springfield  Tech.  Comm.  Coll. 
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Business 
Contin- 
uity Plan 
Date 

Dec-99 

Vendor 
Com- 
pliance 

N/A 

In 

Progress 

No 

No 

Yes 

N/A 

No 

N/A 

No 

No 

Yes 

Yes 

V/N 

No 

V/N 

Facil-ities 
Date 
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Jun-98 
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Mar-99 
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100% 

Date 
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CD 
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CD 
CD 
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CD 
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LAN 

Jan 

Nov 

Jun 

Mar 

Mar 

Feb 

Jun 

Aug 

Jun 

Jun 

# 

Essential 
Systems 

in 

CM 

# 

Mission 
Critical 
Systems 

co 

CM 

Change 

No 
Change 

No 
Change 

No 
Change 

No 
Change 

Slipped 

No 
Change 

No 
Change 

No 
Change 

No 
Change 

Slipped 

No 
Change 

No 
Change 

Slipped 

Slipped 

No 
Change 

No 
Change 

Sep.  98 
PMO 
Status 

Green 

Green 

Green 

Red 

Green 

Red 

Green 

Red 

Green 

Green 

Green 

Red 

Yellow 

Green 

Green 

Green 

Dec.  98 
PMO 
Status 

Green 

Green 

Green 

Red 

Yellow 

Red 

Green 

Red 

Green 

Yellow 

Green 

Red 

Red 

Yellow 

Green 

Green 

Agency 

Pension  Reserves  Investment 
Management  Board 

State  Ethics  Commission 

Water  Pollution  Abatement  Trust 

Admin  Office  of  Trial  Courts 

Appeals  Court 

Board  of  Bar  Examiners 

Comm.  on  Judicial  Conduct 

Supreme  Judicial  Court 

Board  of  Conciliation  &  Arbitration 

Corp.  for  Bus  Work  &  Learning  (was 
Div.  of  Industr 

Div.  of  Apprenticeship 

Div.  of  Employment  &  Training 

Div.  of  Industrial  Accidents 

Div.  of  Labor  &  Workforce  Develop 

Div.  of  Occupational  Safety 

Joint  Labor  Mgmt  Committee 

Secret- 
ariat 

Ind. 

Agency 

Ind. 

Agency 

Ind. 

Agency 

Judiciary 

Judiciary 
Judiciary 

Judiciary 

Judiciary 
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Dev. 
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Dev. 
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Labor 
Dev. 
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Business 
Contin- 
uity Plan 
Date 

Vendor 
Com- 
pliance 

Yes 

No 

No 

No 

In 

Progress 

In 

Progress 

V/N 

Yes 

N/A 

Yes 

N/A 

No 

V/N 

N/A 

Yes 

Yes 

Facil-ities 
Date 

May-99 

Phone 
Date 

Jul-98 

Jun-99 

Feb-99 

May-99 

Aug-98 

Dec-98 

Dec-98 

Jul-97 

S  E« 

05    O  £ 

a 

80-99% 

100% 

100% 

60-80% 

40-60% 

100% 

80-99% 

60-80% 

80-99% 

100% 

60-80% 

40-60% 

60-80% 

100% 

80-99% 

100% 

LAN  Date 

Dec-98 

Dec-98 

Dec-98 

Feb-99 

Dec-98 

Feb-99 

Jan-99 

Dec-98 

Dec-98 

Dec-98 

Jan-99 

Feb-99 

Nov-98 

Dec-98 

# 

Essential 
Systems 
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co 
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# 

Mission 
Critical 
Systems 
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CM 
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Change 

No 
Change 

No 
Change 

No 
Change 

No 
Change 

No 
Change 

Slipped 

No 
Change 
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Status 
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Green 
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Labor  Relations  Comm 
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Bureau  of  Spec.  Investigations 

Chief  Medical  Examiner 
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Dept.  of  Corrections 
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Dept.  of  Public  Safety 

EO  of  Public  Safety 

Gov's  Highway  Safety  Board 

Governor's  Alliance  Against  Drugs 

Mass.  Emergency  Management 

Merit  Rating  Board 
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ariat 
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Dev. 
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Pub. 
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Pub. 
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The  Agency  Business  Continuity  and  Contingency  Planning  Process 

Business  Continuity  Planning 

The  objective  of  Business  Continuity  Planning  is  to  identify  and  assure  that  the  primary,  mission-critical  functions 
performed  by  the  Commonwealth  of  Massachusetts  will  continue  without  significant  interruption  into  and 
throughout  the  year  2000.  Agency  Business  Continuity  Planning  involves  the  following  critical  elements: 


Year  2000  Business 
Continuity  Planning 


Planning  Initiation 

Establish  a  business  continuity  project  work 
group  and  develop  a  high-level  Business 
Continuity  Plannin°  stratepv  Develop  master 

V-'  ullllllUl  l  *     1    11*111111  1  w.    .HI  U  IV  ^  '   .     1  S  t   I  V  IV'U  HIUjlvl 

schedule  and  milestones,  and  obtain  executive 
support. 

Planning 
Risk  Assessment  to 
Primary  Business 
Functions 

Assess  the  potential  impact  of  mission-critical 
system  failures  on  agency's  core  business 
processes.  Define  Year  2000  failure  scenarios, 
and  perform  risk  and  impact  analysis  of  each  core 
business  process.  Assess  infrastructure  risks,  and 
define  the  minimum  acceptable  levels  of  outputs 
for  each  core  business  process. 

Identify  Contingency 
Procedures 

Identify  and  document  contingency  plans  and 
implementation  modes.  Define  triggers  for 
activating  contingency  plans,  and  establish 
business  resumption  team  for  each  core  business 
process. 

Practice  and  Reassess 

Validate  the  agency's  business  continuity 
strategy.  Develop  and  document  contingency  test 
plans.  Prepare  and  execute  tests.  Update  disaster 
recovery  plans  and  procedures. 

System  Contingency  Planning 

The  goal  of  Contingency  Planning  is  to  maximize  an  agency's  functionality  and  speed  of  business  resumption  in  the 
event  of  a  system  Year  2000  failure.  Contingency  planning  integrates  and  acts  on  the  results  of  an  agency's  risk 
management  and  business  continuity  planning  processes.  The  output  of  this  integration  is  a  set  of  contingency  plans 
-  with  a  single  plan  established  for  each  mission  critical  process  and  infrastructure  component.  Each  contingency 
plan  provides  a  description  of  the  resources,  staff  roles,  procedures  and  timetables  needed  for  its  implementation. 
The  three  critical  process  steps  to  System  Contingency  Planning  are: 


Year  2000  System 
Contingency 
Planning 


Functionality 

The  degree  to  which  the  replacement  functionally 
supports  the  production  of  a  minimum  acceptable 
level  of  output  for  a  given  core  business  process. 

Deployment 

The  time  needed  to  acquire,  test  and  implement. 

Cost 

Life  cycle  cost,  including  acquisition,  testing, 
training  and  maintenance. 

To  assist  agencies  with  their  Business  Continuity  and  System  Contingency  Planning  processes,  the  ITD  Y2K.  PMO 
has  designed  templates  that  addresses  the  specific  elements  of  effective  plans.  The  templates  have  been  made 
available  to  agencies  in  both  hard  copy  and  appear  on  the  Y2K  PMO  web  site. 
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Year  2000  Business  Continuity  Plan  for 
Agency  X 

Preface 

The  Commonwealth  of  Massachusetts,  Year  2000  Program  Management  Office  has  developed  this  Year  2000 
Business  Continuity  Plan  Template  to  facilitate  the  efforts  of  Commonwealth  agencies  engaged  in  Year  2000  risk 
management  and  business  continuity  planning.  The  template  is  intended  primarily  for  Agencies  that  have  not 
previously  performed formal  business  continuity  planning,  but  other  agencies  may  find  the  approach  and  tables 
helpful.  The  template  can  be  used  as  a  guideline  to  assist  in  conducting  planning  sessions  as  well  as  to  record 
outputs  of  planning  sessions.  Agencies  are  encouraged  to  use  the  template  throughout  their  Year  2000  business 
continuity  planning  efforts,  and  to  publish  updates  at  critical  milestones. 

Note  that  conventional  wisdom  dictates  that  6  to  9  months  are  required  to  develop  a  good 
business  continuity  plan.  This  includes  time  to: 

•  Develop  the  plan,  the  detailed  contingency  plans,  and  any  required  implementation  and  training  materials 

•  Provide  necessary  training 

•  Test  or  drill  selected  contingency  plans 

•  Perform  other  preliminary  tasks  required  for  specific  contingency  plans,  e.g.,  establish  contracts  with 
back-up  suppliers  or  secure  additional  staff. 

The  template  contains  generic  references  like  "Agency  X"  which  each  agency  is  expected  to  replace  with  agency- 
specific  references.  The  template  also  contains  numerous  examples  and  explanatory  comments  to  advise  how 
certain  sections  should  be  completed.  These  sections  are  clearly  marked  using  shaded,  blue  text  in  italics  and 
should  be  deleted  or  replaced for  the  final  version  of  the  document.  Agencies  are  expected  to  further  tailor  the 
template  as  required  to  meet  internal  standards  or  other  agency  objectives. 

1.  Introduction 


1.1  Purpose 

The  purpose  of  this  Year  2000  business  continuity  planning  document  is  to  describe  how  Agency  X  plans  to 
minimize  the  impact  of  a  Year  2000-induced  failure  or  event  on  the  operations  of  Agency  X  and  the  services  it 
provides  to  die  Commonwealdi  of  Massachusetts.  This  document  identifies  likely  Year  2000  hazards  diat  will  or 
could  impact  Agency  X;  describes  the  Year  2000  projects  and  risk  mitigation  activities  currently  planned,  completed 
or  underw  ay  to  ensure  maximum  preparedness;  and  defines  the  contingency  plans  that  Agency  X  will  implement  in 
response  to  Year  2000  events. 

1.2  Scope 

Executive  management  as  indicated  by  the  signatures  on  the  cover  has  reviewed  this  plan  and  die  contingency  plans 
described  in  this  document.  The  plans  described  in  this  document  shall  apply  to  all  sites  except  as  listed  below : 

•  List  any  exceptions  here 

The  following  personnel  categories  are  expected  to  review  this  plan: 

•  List  by  job  description/title 
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1.3  Strategy 

Agency X  recognizes  that  the  Year  2000  problem,  while  technical  in  nature,  is  primarily  a  business  problem.  To 
effectively  meet  the  Year  2000  challenge,  the  agency  has  initiated  a  number  of  Year  2000  preparedness  activ  ities 
and  has  established  a  Year  2000  business  continuity  planning  program.  Year  2000  preparedness  activities  are 
identified  briefly  in  Sections  4  and  5  of  the  document  to  provide  a  more  complete  picture  of  die  overall  effort,  but 
the  primary  focus  of  the  document  is  to  describe: 

•  The  Year  2000  hazards  that  could  cause  an  interruption  to  agency  services,  in  spite  of  all  preparedness 
activities, 

•  How  the  agency  will  act  in  response  the  hazards  to  resume,  and 

•  The  steps  required  to  return  to  normal  operations 

Agency X's  Year  2000  business  continuity  planning  program  was  launched  by  naming  an  integrated  team 
representing  all  segments  of  the  agency: 

•  Name  -  Title  and/or  Functional  Area 

The  team  should  include  key  personnel  from  the  executive  management,  major  business  units,  legal,  finance, 
procurement,  operations,  engineering,  and  IS  as  well  as  the  agency's  Year  2000  project  manager  (s)  who  are  well 
aware  of  the  current  risks  facing  the  various  remediation  and  preparedness  projects. 

The  Year  2000  business  continuity  planning  team  meets  weekly  and  reports  directly  to  Agency  Head.  The  planning 
effort  addresses: 

•  Organization 

•  Determining  how  the  business  continuity  planning  team  will  coordinate  with  other  Year  2000  efforts 
underway  in  the  agency 

•  Establishing  documentation  standards  and  quality  assurance  criteria  for  required  contingency  plans 

•  Developing/maintaining  a  master  schedule  for  the  planning  effort  and  die  delivery  of  interim  and  final 
products 

•  Tracking  progress 

•  Hazard  identification 

•  Identifying  the  agency's  primary  services 

•  Determining  operation  priorities  and  minimum  acceptable  service  levels 

•  Determining  potential  system  failure  modes,  e.g. : 

•  The  system  is  able  to  process  non-date  sensitive  information 

•  The  system  produces  results  with  incorrect  but  acceptable  errors 

•  The  system  generates  unreliable  and/or  unpredictable  results 

•  The  system  will  not  function 

•  Identifying  the  business  dependencies  for  each  service,  e.g.,  IT  systems,  embedded  devices,  external 
service  providers,  suppliers,  key  personnel,  specific  facilities 

•  Identifying  additional  Year  2000  hazards  to  each  service,  e.g.,  power  surges/outages,  disruptions  to 
transportation  and  communications  infrastructure 

•  Analysis 

•  Assessing  the  various  hazards  and  identifying  contingency  options 

•  Assessing  existing  business  continuity  and  disaster  recovery  plans 

•  Evaluating  and  selecting  contingency  options  to  develop,  including  estimation  of  resources  and 
development  schedule 

•  Recommending  additional  preparedness  activities  to  die  Year  2000  project  manager(s) 

•  Development 

•  Assigning  personnel  to  develop  contingency  plans 

•  Developing  and  documenting  contingency  plans,  including  all  related  materials  and  preliminary 
activities 

•  Reviewing  contingency  plans 

•  Final  Preparation 
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•  Testing,  training,  and  practicing  contingency  plans 

•  Assigning  personnel  to  implement  contingency  plans 

1.4  Preparation  and  Timeliness 

This  document  has  been  prepared  in  a  phased  approach  to  record  the  findings  and  decisions  of  the  Year  2000 
Business  Continuity  Planning  team. 

At  the  time  of  publication  the  following  issues  remain  open: 

•  List  all  known  open  issues 

These  items  will  be  addressed  in  future  revisions  to  this  document.  The  next  update  to  this  document  is  scheduled 
for  Month,  Year. 

Please  forward  any  comments  on  this  document  to: 

•  Name,  phone,  e-mail  address 

1.5  References 

•  "Managing  Year  2000  Risks",  Commonwealth  of  Massachusetts,  Information  Technology  Division.  Year 
2000  Program  Management  Office,  September  23,  1998. 

•  "Year  2000  Computing  Crisis:  Business  Continuity  and  Contingency  Planning".  United  States  General 
Accounting  Office,  Accounting  and  Information  Management  Division.  March  1998. 

•  "Y2K  Contingency  Plan  Guidelines",  The  MITRE  Corporation, 
http://www.  rnitre.org/research/y2k/docs/CONTrNGENCY_PL  AN.  html 

•  The  Millennium  Problem  in  Embedded  Systems,  Chapter  15,  "Year  2000  Contingency  Planning  for 
Embedded  Systems",  The  Institution  of  Electrical  Engineers, 
http://www.iee.org.uk/2000risk/updates/chapt_15.htm 

•  Add  relevant  agency  documents,  e.g.,  existing  disaster  recovery  plans,  contingency  plans,  and  Y2K  risk 
management  documents. 
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2.  Year  2000  Risk  Management  Terminology 

The  terminology  used  in  discussions  of  risk  management  and  business  continuity  planning  often  varies  from  source 
to  source  or  seems  vague.  This  section,  provided  by  the  Commonwealth  of  Massachusetts,  Year  2000  Program 
Management  Office,  attempts  to  clarify  key  terms  that  are  used  throughout  the  remainder  of  this  document. 

Risk 

Fully  specified,  a  risk  statement  has  3  parts: 

•  The  risk  condition  or  event  or  hazard 

•  The  probability  of  the  hazard 

•  The  impact  of  the  hazard 

Risk,  as  it  applies  to  Year  2000,  can  be  defined  as  the  probability  a  Commonwealth  agency-  will  experience  an 
interruption  or  failure  to  provide  critical  services  to  citizens  due  to  Y2K  problems.  The  impacts  associated  with 
Year  2000  risks  are  typically  measured  in  terms  of  financial  cost  to  the  agency  or  expense  to  taxpayers,  but  some 
can  be  measured  m  terms  of  loss  of  credibility. 

Risks  should  also  be  identified  for  Year  2000  projects.  A  Year  2000  project  risk  is  the  probability  that  a  project  fails 
to  meet  one  or  more  of  its  objectives,  such  as  its  major  schedule  milestones.  The  impact  of  the  failure  is  usually 
measured  in  terms  of  financial  cost  to  the  agency  but  items  like  staff  morale  and  impact  on  other  agency  activities 
and  priorities  should  also  be  considered. 

Hazard  (or  Source  of  Risk) 

Hazards  or  sources  of  risk  can  be  categorized  as  internal  or  external.  Internal  Year  2000  hazards  include  potential 
problem  areas  like  the  following: 

•  Technical 

•  Incomplete/inaccurate  inventory/assessment  of  IT  systems  and  embedded  devices 

•  Scope 

•  Complexity 

•  Failure  dates 

•  Defects  created  during  remediation  and  testing  phases 

•  Inadequate  system  documentation 

•  Impaired  interoperability  with  remediated  third-party  products 

•  Nonfunctioning  or  data-altering  interfaces 

•  Undetected  errors 

•  Inability  to  detect  errors  in  timely  manner 

•  Project 

•  Inadequate  support  from  executive  management 

•  Optimism,  denial,  or  lnsensitivity  to  risks 

•  Inadequate  estimates  of  resource  requirements 

•  Loss/unavailability  of  key  personnel 

•  Inadequate  remediation  or  test  environment 

•  Staff  expertise 

•  Staff  turnover 

•  Schedule  delays 

•  Ramp  up  time  for  new  staff 

•  Learning  curve  for  new  tools,  methods 
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•  Delays  in  project  dependencies 

•  Unforeseen  problems 

•  Inadequate  estimates  of  budget  requirements 

•  Inadequate  funding 

•  Legal 

•  Payment  terms  and  conditions 

•  Year  2000  warranties 

•  License  agreement 

•  Litigation 

External  hazards  includes  items  like: 

•  Vendors 

•  Inaccurate  or  ambiguous  compliance  information 

•  Inability  to  develop  a  compliant  version  of  the  product 

•  Insufficient  testing  of  compliant  versions  of  the  product 

•  Delays  in  developing  compliant  version  of  the  product 

•  Delay  in  shipping  compliant  version  of  the  product  due  to  backlog 

•  Ability  to  stay  in  business  to  address  any  new  compliance  issues 

•  Suppliers  and  Service  Providers 

•  Ability  to  deliver  in  a  timely  manner 

•  Ability  to  stay  in  business 

•  Data  exchange  partners 

•  Erroneous  assumptions  about  shared  file  structures 

•  Delivery  of  corrupted  data 

•  Coordination 

Risk  Management 

Rjsk  management  is  the  process  an  agency  employs  to  proactively  monitor  Year  2000  risks  and  to  implement  risk 
mitigation  activities.  This  process  is  intended  to  ensure  maximum  preparedness  for  problems  that  may  occur  at  the 
century  changeover.  Risk  management  includes  the  following  key  steps: 

•  Risk  identification. 

•  Risk  assessment 

•  Determination  of  risk  mitigation  options 

•  Risk  mitigation 

•  Tracking  progress  and 

•  Repeating  the  process 

Risk  Identification 

The  purpose  of  risk  identification  is  to  list  the  possible  Year  2000  failures  or  hazards  This  activity  is  often 
performed  by  examining  the  various  sources  of  risks.  (See  "Hazard"  above.) 

Risk  Assessment 

During  risk  assessment,  hazards  are  analyzed  to  determine: 

•  The  cost/impact,  and 

•  The  estimated  probability  the  event  will  occur. 

At  the  conclusion  of  this  step,  the  risks  are  prioritized  for  risk  mitigation. 
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Risk  Mitigation 

Risk  mitigation  is  die  action  or  set  of  actions  put  in  place  specifically  to  reduce  (1)  the  probability  that  a  risk  will 
occur  or  (2)  the  cost/impact  of  a  risk.  Year  2000  remediation  projects  for  mission  critical  and  essential  systems  are 
efforts  intended  to  reduce  the  probability  of  Year  2000  risks,  while  the  goal  of  contingency  planning  is  primarily  to 
reduce  the  impact  of  a  Year  2000  failure. 

Risk  mitigation  activities  can  also  be  classified  as: 

•  Preparedness  activities  for  efforts  initiated  and  completed  prior  to  expected  failure  dates  includes  actions 
like: 

•  Involvement  of  executive  management  to  ensure  remediation  efforts  are  scheduled  and  performed  in 
accordance  with  business  priorities 

•  Development  of  procedures  to  recognize  degradation  of  system  functions 

•  Development  of  methods  to  preserve  and  protect  system  data 

•  Development  of  methods  to  detect  and  correct  corrupt  data 

•  Staffing  plans  and  incentives  for  personnel 

•  Independent  Verification  and  Validation 

•  Year  2000  awareness  programs  for  end-users 

•  Development  of  Year  2000  business  continuity  plans 

•  Business  continuity  and  contingency  plans  for  efforts  that  will  be  initiated  in  response  to  Year  2000  trigger 
events 


Contingency  Plan 

With  respect  to  business  operations,  a  contingency  plan  specifies  an  alternative  approach  for  providing  a  service  or 
fulfilling  a  function  that  can  be  put  into  effect  if  a  Year  2000  event  occurs  that  significantly  disrupts  normal 
operations.  Contingency  plans  are  the  primary  products  of  Year  2000  business  continuity  planning  efforts.  For 
example,  a  contingency  plan  for  performing  services  out  of  Site  A  if  Site  B  is  unavailable.  Contingency  plans 
developed  for  business  continuity'  plans  tend  to  fall  into  3  categories: 

•  Emergency  response 

•  Primary  contingency 

•  Long-term  contingency 

Contingency  plans  can  also  be  part  of  a  Year  2000  preparedness  effort.  For  example,  a  Year  2000  project  team  that 
lias  a  very  aggressive  schedule  for  remediating  a  legacy  system  may  require  a  contingency  plan  to  develop  a  patch 
for  the  production  system  if  the  remediation  effort  fails  to  meet  a  certain  milestone  by  a  specified  date.  This 
contingency  plan  is  properly  a  part  of  the  remediation  effort  rather  than  the  business  continuity'  planning  effort. 


Trigger 

An  event  that  indicates  implementation  of  a  contingency  plan  may  be  required.  A  trigger  requiring  an  emergency 
response  is  often  the  occurrence  of  a  hazard.  A  trigger  for  a  primary  contingency  plan  may  be  the  inability'  of  the 
maintenance  team  to  correct  a  defect  within  24  hours  of  a  system  failure.  A  trigger  for  a  long-term  contingency  plan 
could  be  the  occurrence  of  one  or  more  hazards  that  indicate  normal  operations  cannot  be  restored  for  an  indefinite 
amount  of  time. 


Business  Continuity  Planning 
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The  goal  of  business  continuity  planning  is  to  develop  a  set  of  interim  business  processes  that  w  ill  protect  business 
interests  during  an  operational  discontinuity.  Year  2000  business  continuity  planning  includes  activities  to: 

•  Identify  and  evaluate  likely  Year  2000  events  that  may  occur  in  spite  of  all  previously  defined  Year  2000 
preparations 

•  Develop  contingency  plans  that  the  agency  will  put  in  place  in  response  to  a  Year  2000  event 

•  Develop  recovery  plans  for  the  return  to  normal  operations  after  the  need  for  the  contingency  action  has 
passed. 

Business  continuity  plans  must  consider  health  and  safety  ,  customer  services  and  deliveries,  access  to  supplies,  and 
business  operations.  They  must  describe  the  actions  the  agency  will  take  to  ensure  continuity  of  core  business 
processes. 

For  a  certain  set  of  Year  2000  events,  the  appropriate  Year  2000  business  continuity  plan  will  mirror  the  agency's 
general  business  continuity  (or  disaster  recovery)  plan.  For  other  Year  2000  events,  an  existing  disaster  recovery 
plan  offers  no  solution  because  the  cause  of  the  event  will  also  exist  at  the  hot  site  or  on  the  backup  device/softw  are 

In  this  document.  Year  2000  business  continuity  planning  is  viewed  as  an  integral  part  of  the  Year  2000  risk 
management  program,  rather  than  an  adjunct  to  general  business  continuity  (or  disaster  recover)  )  planning  since: 

•  The  staff  performing  Year  2000  business  continuity  planning  often  includes  a  significant  portion  of  the 
staff  performing  the  more  general  Year  2000  risk  management  program. 

•  Status  of  existing  Year  2000  projects  will  impact  the  identification  and  evaluation  of  likely  Year  2000 
events  being  considered  for  business  continuity  planning. 

•  The  business  continuity  activities  to  identify  and  evaluate  likely  Year  2000  events  may  lead  to  the 
identification  of  additional  Year  2000  projects  (or  new  tasks  for  existing  Year  2000  projects)  that  can  be 
launched  immediately  to  reduce  the  probability  of  a  risk. 
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3.  Year  2000  Hazards  for  Agency  Services 

This  section  describes  the  primary  serv  ices  provided  by  Agency  X  and.  identifies  possible  Year  2000  hazards  that 
could  cause  a  disruption  ui  the  delivery  of  these  services.  Contingency  plans  to  offset  the  possible  disruptions  are 
also  identified.  They  are  described  in  detail  in  Section  6. 

3. 1     Primary  Services  Provided 

Identify  all  significant  services  provided  by  the  agency.  Be  sure  to  include  the  non-U 'business function  experts  to 
ensure  identification  of  critical  services  that  may  not  depend  directly  on  FT  systems  but  may  rely  on  infrastructure, 
key  suppliers,  and  external  service  providers. 

These  ser\>ices  should  be  defined  at  a  level  of  detail  that  allows  meaningful  analysis  of  the  hazards  and  identification 
of  contingency  options,  but  not  so  detailed  that  this  process  becomes  overly  tedious.  The  Year  2000  Business 
Continuity  Planning  team  may  need  to  iterate  the  listing  of  services  with  the  other  analysis  steps  in  Section  3  before 
finalizing  the  list.  It  is  recommended  that  agencies  begin  with  a  short  list  of  services. 


u 

1.0 

Service  Description 

Reimburse  vendors  for  xxx 

Recipients' 

Maximum 
Allowable 
Disruption 
(Days)2 

Criti- 
cality3 

Agency  Point  of 
Contact4 

1.1 

Maintain  xxx  database 

1.2 

Process  invoices 

13 

Issue  checks 

2.0 

xxx 

8.0 

General  Operations 

8.1 

Maintenance  support  for  xxx 

8.2 

Hot-line  for  xxx 

8.3 

Help  desk  for  xxx 

8.4 

Analyze  data  on  xxx 

8.5 

Publish  information  on  xxx 

'  Brief  description  of  who  depends  on  this  service. 

2  Maximum  time  disruption  can  exist  without  agency  implementing  contingency  plan. 

3  Mission  Critical.  Essential  or  Other  Required. 

4  Person  responsible  for  authorizing  a  contingency  action  in  case  of  service  disruption. 


3.2     Year  2000  Hazard  Analysis  for  Services 

For  each  service  listed  in  the  table  provided  in  Section  3.  J,  use  the  table  below  to  identify  the  possible  Year  2000 
hazards  that  could  cause  an  interruption  of  the  sen>ice.  Then  identify  the  emergency  responses  and  contingency 
plans  required  to  contend  with  the  interruption.  A  complete  listing  of  hazards  requires  a  thorough  assessment  of  the 
dependencies  for  each  service. 

Note  that  it  is  expected  that  many  contingency  plans  will  address  multiple  hazards  for  a  specific  sendee  and  some 
contingency  plans  will  address  similar  hazards  for  multiple  services.  Most  agencies  will  find  it  easier  to  first 
identify  the  needed  contingency  plans  for  each  service  &  hazard  and  then  try  to  group  and  merge  the  contingency 
plans  before  beginning  the  contingency  plan  specification  process. 
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Note  that  the  table  is  a  subset  of  the  HazAnalysisWorksheet.xls,  which  may  be  more  helpful  during  working  sessions. 

This  section  identifies  possible  Year  2000  hazards  that  could  cause  a  disruption  of  agency  and  the  contingency  plans 
(including  emergency  responses)  the  agency  will  employ  to  counter  a  disruption.  Descriptions  of  the  various 
contingency  plans  are  described  in  Section  6. 


3.2. 1    Service  Description  1  (this  should  match  the  first  service  description  listed  in  the  table  in 
Section  3.1) 


■                        .  ■  .   ■  -■■  

Year  2000  Hazard 

......  ..  ...  . 

..              ..  :. 

Emergency 

Descriptions  & 
Section  6  Refs 

Duration 
of 

Hazard 
(Days) 

A  V\T\  TfW  TF*f\ 

Primary 

V.\/il Liif  tCv  11  v  * 

Descriptions  & 
Section  6  Refs 

Long 

Tptto 

1  CI  L  LI 

Duration 
of 

Hazard 
(Days) 

A  nnrn^  :f^r\  T  f\x\  o 

Term 

(^ah  t  i  t\<jp  nrv 

V_- vrxi III  l    w  I iy\ 

Descriptions  & 
Section  6  Refs 

Facilities 

Electricity  outage  at 
LiOcaiion  a. 

Security  outage  at 
Location  X 

Phone  system  outage  at 
Locanon  a. 

A  f      y\  t*S*k  r~%  I/O  y»J  C  Sit 

riv  j±k_  prooicrrfS  ai 

Personnel 

lij  olLljJ  UriUVldilCJUl  l lijV  Lit 

Location  X 

\  .  1  SI  t  M  t  Si  ISt  SI  M  S^  S3     C*t  SI  IT 

jviuiniifncinuc  ^icijj 
unfTvfiilnhilifv*  nt 
I  oration  Y 

(Inprntion^  stnff 

unavailability*  at 
Location  X 

Management  staff 
unavailability1  at 
Location  X 

External 

 ■ 

Loss  of  Supplier  A 

Loss  of  Vendor  B 

Loss  of  Service  Provider 

C 

Loss  of  Interface  with 
Organization  D 

IT 

Loss  of  System  A 

Loss  of  System  B 

Degradation  of  ABC 
Database 
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LOSS  OJ  LA  A  'n  ASS 

End  Users 

j  ......  ^fi  no/    f  Df^c 

Loss  OJ  lUvo  OJ  ri^S 

Corrupted'lost  files 

 ,    ,  ,  ,  ,   

Embedded  devices 

Problem  with  device  type 
0 



Problem  with  device  tvpe 
R 

Basic  Community  Services 

General  electricity 
outage  or  power  surges 

General  telephone 
service  outage  or 
restrictions 

Restricted  water  supplies 

Impaired  public 
transportation 

'  Unavailability  of  staff  may  occur  at  locations  having  no  Y2K  problems  due  to  Y2K  transportation 
problems  or  Y2K  problems  affecting  employees'  home  communities. 


3.2.2     Service  Description  2  (from  table  in  Section  3.1) 


Repeat  the  format  as  in  Section  3. 2. 1  for  as  many  of  these  sections  as  there  are  sendees. 


......  ■ 

Long 

Approved 

Emergency 

Response 

Probable 

Approved 

Term 

Approved  Long 
Tenn 

Contingency 

Duration 
of 

Primary 
Contingency 

Duration 
of 

Year  2000  Hazard 

Descriptions  & 
Section  6  Refs 

Hazard 
(Days) 

Descriptions  & 
Section  6  Refs 

Hazard 
(Days) 

Descriptions  & 
Section  6  Refs 
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4.  Year  2000  Preparedness  Activities 

Tins  section  describes  the  primary  Year  2000  preparedness  activities  performed,  planned,  or  in  progress  at  Agency 
X. 

It  is  expected  that  this  section  will  initially  reflect  Year  2000  remediation  projects  launched  prior  to  the  designation 
of  the  Business  Continuity  Planning  team,  but  that  the  section  will  grow  as  the  team  evaluates  Year  2000  hazards 
and  identifies  additional  preparedness  activities  that  should  be  implemented. 


4.1     Assessment/Remediation/Replacement  Projects 


Includes 

Includes 

Project  Description 

Actual/ 
Scheduled 

Future 
Date 

Includes 

Contin- 
gency 

Contingency 

Point  of 
Contact 

Completion 
Date 

Testing 
(Yes/No) 

IV&V 
(Yes/No) 

Plans 
(Yes/No) 

Plan 

References 

Svstem  A 

System  B 

Agency  PCs 

Agency  LANs/WANs 

Facility  1 

Facility  2 

Phone^oice  mail  system  1 

4.2     A  waren ess/T raining  Programs 


Actual/ 
Scheduled 
Completion 
Date 

Program  Description 

Target  Group 

Point  of 
Contact 

Strategies 

General  Awareness 

All  agency 
personnel 

3/1/2000 

Agency  newsletter;  agency  web 
site  on  intranet 

Executive  A  wareness 

Upper 

management 

Year  2000  project  reviews 

Y2K  Team  Development 

Y2K  team 

Attend  Commonwealth  Y2K  User 
Group  and  workshops;  attend 
DCI  conference  on  contingency 
planning 

PC  BIOS  Issues 

PC  support  staff 

Training  program  for  PC  support 
staff  at  all  sites 

Excel  Spreadsheet 
Verification 

End  users 

User  information  document; 
designation  of  Excel  guru  and 
purchase  of  spreadsheet  scanning 
tool  to  assist  users;  hour-long 
training  session 
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4.3     Additional  Year  2000  Risk  Mitigation/Preparedness  Programs 


Program  Description 

Y2K  Risk  Management 
Program 

Scope 

All  agency  Y2K 
projects 

Point  of 
Contact 

Status* 

Comments 

Business  Continuity 
Planning 

Agency-wide 

Formal  Vendor 
Management  Program 

Letters  on  fie  for  critical  vendors 

Contracts  Review 

Forms  Review 

All  preprinted 
forms  used  by 
agency 

Complete 

Changes  required  for  2000  ha\>e 
been  identified;  procurement  for 
2000  is  scheduled  for  Oct  99 

Staffing  plan  for  Dec.  1, 
1 999 -Jan.  31,  2000, 
including  identification  of 
swat  teams 

Description  in  Section  5. 1 

Year  2000  Roll-Over  Plan 
for  IT  systems 

Systems  A,  B, 
and  C  and 
Database  X 

Materials 
in  progress 

Description  in  Section  5.2 

On-site  maintenance 
personnel  monitoring 
critical  embedded  devices 
during  the  century  roll-over 

Year  2000  Roll-Over  Plan 
for  year-end  run  of  XXX 

Identified 

Intent  is  to  close  books  Dec.  22, 
99  and  run  year-end  XXX  on  Dec. 
27,  99  rather  than  Jan.  5,  2000. 

Data  Integrity  Procedures 
for  Database  X  &  Report  Y 

Materials 
in  progress 

See  "Year  2000  Roll-Over  Plan 
for  IT  systems" 

Data  Integrity  Procedures 
for  Interfaces  with 
Organization  0 

Establishment  of  support 
agreements  with  Supplier  Z 

In  contract  negotiations 

Contract  with  XYZ  for  on- 
site  support  forXXXX 

Order  supplies  required  for 
Jan-Feb  2000  operations  by 
Oct  1999 

Lists  &  procedures  for 
emergency  notification  of 
personnel 

Materials 
in  progress 

These  lists  will  support  a  variety 
of  contingency  plans. 

Additional  Y2K 
Preparations  and  Checklists 
for  Agency  Help  Desk 

Establishment  of  a  short 
term  help  desk  for  PC  users 

Procedures  to  identify 
securitv  breaches 

Procedures  and  standards 
for  new  personnel  to  ensure 
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compliance  is  maintained.  

*  Status:  Identified.  Defined.  Approved.  Materials  in  Progress  (procedures/training  materials  are  being  developed). 
Training  in  progress;  Ready 
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5.  Century  Roll-Over  Plans 

In  spite  of  all  the  Year  2000  remediation  efforts  underway  or  completed.  Agency  X  understands  that  there  is  a  high 
likelihood  of  multiple  defects  that  will  occur  during  the  December  31,  1999  to  January  I,  2000  roll-over.  Wlule 
most  of  these  defects  are  expected  to  be  rather  straightforward  to  resolve,  it  is  possible  that  the  number  of  problems 
may  overwhelm  the  normal  maintenance  process.  To  proactively  counter  and  control  this  scenario.  Agency  X  plans 
to  implement  the  following  roll-over  plans. 

Agencies  should  also  consider: 

•  The  need  to  place  orders  to  suppliers  early  to  ensure  delivery  before  January  1,  2000  wherever  possible. 

•  Possible  increased  demands  from  the  public  requesting  information  on  how  to  cope  with  Year  2000 
problems. 

•  Possible  increased  demands  by  end-users  on  PC  support  groups  and  help  desks. 

5.1  Staffing  Plan  for  Dec.  1,  1999-  Jan.  31,  2000,  Including  Identification  of 
Swat  Teams 

This  section  should  describe  the  personnel  requirements  needed  for  the  century  roll-over.  The  Year  2000  Business 
Continuity  Planning  team  should  include  personnel  required  to  perform  proactive  roll-over  plans  as  well  as 
personnel  required  to  field  Year  2000  "swat"  teams  which  will  respond  to  Year  2000  problems  as  they  occur.  The 
staffing  plan  should  also  describe  how  the  agency  will  ensure  availability  of  the  personnel.  For  example,  an  agency 
may  decide  to  deny/limit  vacation  time  to  key  personnel  during  this  period.  Depending  on  the  criticality,  the  staffing 
plan  may  need  to  address  communications  and  transportation  contingencies  for  key  personnel. 

Swat  teams  may  be  needed  for 

•  Setting  priorities/triage 

•  IT  systems 

•  Non-IT  systems 

•  Communications  (to  ensure  executive  management,  personnel  at  affected facilities,  users,  data  exchange 
partners,  vendors,  constituents,  etc.  have  been  alerted  to  the  existence  of  a  problem  and  the  launch  of  a 
contingency  plan). 

Note  that  staffing  plans  should  not  depend  on  single  individuals.  Alternative  personnel  must  be  identified. 

5.2  Year  2000  Roll-Over  Plan  for  Systems  A,  B,  and  C 

This  section  describes  the  roll-over  plan  for  specific  major  systems.  In  the  following  example,  the  basic  contingency- 
plan  form  is  used  (see  also  the  PMO 's  Year  2000  Contingency  Plan  template). 

The  primary  goal  for  a  Year  2000  Roll-Ch'er  Plan  is  to  avoid  defects  that  are  expected  to  only  occur  during  on-line 
Year  2000  roll-over.  By  powering  down  before  the  century  roll-over  and  powering  up  after  the  century  roll-over  the 
roll-over  hazard  is  avoided.  This  approach  has  the  additional  advantage  of  allowing  the  systems  to  be  brought  back 
into  production  in  a  highly  controlled  environment  that  facilitates  early  identification  of  other  latent  defects. 

Date  Last  Revised:  November  3,  1998 
Date  Last  Reviewed: 
Approved  by: 

Probable  Trigger  Event(s):  January  1,  2000 
Probable  Trigger  Event  Date(s):  January  1,  2000 
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Probability  (<20%,  20-40%,  40-60%,  60-80%,  >80%):  60-80% 

Description  of  Impact:  Numerous  IS  glitches 

Estimate  of  Financial  (e.g.,  loss,  liabilities,  and  fines)  Impact: 

Estimate  of  Intangible  Impact  (l=Very  Low,  2=Low,  3=  Medium,  4=High;  =5Very  High): 

Expected  Time  to  Implement:  Within  one  day  of  trigger  occurrence 

Agency  Contact  if  trigger  event  occurs:  Name,  phone  number,  pager 
Alternate  Contact:  Name,  phone  number,  pager 

Assumptions:  facility  operations  and  personnel  availability  are  normal  through  December  29, 1999  and  after 
January  2,  2000 

Goal(s):  (I)  avoid  defects  that  only  occur  during  on-line  Year  2000  roll-over.  (2)  detect  and  correct  existing  Year 

2000  defects  in  a  controlled  environment. 

Expected  Change  in  Impact  if  Contingency  Plan  Is  Implemented: 

Expected  Duration  of  Plan: 

Maximum  Duration  of  Plan: 


Contingency  Actions  and  Requirements: 


Action 

Resources 
Required* 

Procedures/ 

Materials 

Required 

Training/ 

Drills 

Required 

Lead 
Time 
Req'd 

Est. 
Cost  to 
Prepare 

Est. 
Cost  to 
Perform 

Employ  data  integrity 
tests/ procedures  on  databases 
at  monthly  intervals  starting 
May  1999 

data  integrity 
tests/procedur 
es  for 
databases 

Perform  weekly  database 
backups  starting  November 
15,  1999 

Employ  data  integrity 
tests/procedures  on  databases 
at  weekly  intervals  starting 
December  1999 

Perform  daily  database 
backups  starting  December 
28.  1999 

Employ  data  integrity 
tests/procedures  on  databases 
daily  starting  December  1999 

Schedule  a  power  down  for 
XXX  on  December  29,  1999 

Power  up  and  verify  platform 
XXX  on  January  3,  2000 

Bring  up  and  verify  System  A 

Bring  up  and  verify  System  B 

Bring  up  and  verify  System  C 

Verify  database  X 

Staffing  and  equipment 


Total  Cost  to  Prepare  for  Contingency  Plan  Implementation  (materials  development,  training,  new  contracts): 

Total  Cost  to  Implement  Plan  (for  expected  duration  of  plan): 

#  Business  Days  Required  to  Implement: 

Possible  Constraints: 

Date  Procedures/Materials  Completed: 

Date  Training/Drills  Completed: 
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Date  Contingency  Plan  Tested: 

Other  Contingency  Plans  Related  to  Tins  Risk:  (provide  references) 

Other  Comments:  If  additional  documentation  for  this  plan  is  available  (e.g.,  a  detailed  plan,  written  procedures 
training  materials),  include  the  reference  here. 

Note:  Complex  contingency  plans  will  require  more  detailed  documentation. 
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6.  Business  Continuity  Contingency  Plans 


This  section  describes  the  contingency  plans  (including  emergency  responses)  the  agency  will  employ  to  counter 
disruptions  identified  in  Section  3.  These  include  the  following: 


Contingency 

JrOini  01 

Actual/ 
Scheduled 

i^o  mp  i  en  on 

tnu- 

Type 
Facility 

Contingency  Plan  Description 

Emergency  Response  for 
electricity  outage  at  Location  X 
(assuming  other  facilities  OK) 

Contact 

Date 

caliry' 

Status1 

6Ref 

Personnel 

Overcoming  maintenance  staff 
unax'ailability1  at  Location  X 

Supplier 

Vendor 

Service 
Provider 

External 
Interface 

IT 

Emergency  Response  for  Loss 

UJ  OyoMZitl  Si 

IT 

Remediation  of  System  B  is 
delayed  beyond  expected 
failure  date 

IT 

Response  to  degradation  of 
ABC  Database 

IT 

Loss  of  LAN/WAN 

End  User 

Embedded 
Device 

Basic 

Community 
Service 

Loss  of  electricity  to  all 
facilities 

1  Mission  Critical,  Essential  or  Other  Required. 

2  Status:  Identified.  Defined,  Approved,  Materials  in  Progress  (procedures/training  materials  are  being 
developed).  Training  in  progress;  Ready 


The  above  table  is  used  to  establish  an  order  to  the  contingency  plans  that  is  potentially  different  from  the  order  the 
contingency  plans  appear  in  the  document.  This  allows  the  contingency  plans  to  be  added  to  the  document  in  order 
of  development. 

6.1.    Contingency  Plan  A 


6.1.1  Description 
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This  section  provides  a  brief  overview  of  the  contingency  plan.  It  is  a  completed  contingency  plan  form  provided  in 
the  PMO 's  Year  2000  Contingency  Plan  template.  The  form  can  also  be  used  separately  during  working  sessions  to 
capture  information  needed  to  evaluate  and  compare  various  contingency  options 

Date  Last  Revised: 
Date  Last  Reviewed: 
Approved  by: 

Probable  Trigger  Event(s) :  Remediation  effort  does  not  meet  Milestone  X  by  date 

Probable  Trigger  Event  Date(s): 

Probability  (<20%,  20-40%,  40-60%,  60-80%,  >80%): 

Description  of  Impact: 

Estimate  of  Financial  (e.g.,  loss,  liabilities,  and  fines)  Impact: 

Estimate  of  Intangible  Impact  (l=Very  Low,  2=Low,  3=  Medium,  4=High;  =5  Very  High): 

Expected  Time  to  Implement:  Within  one  day  of  trigger  occurrence 

Agency  Contact  if  trigger  event  occurs:  Name,  phone  number,  pager 
Alternate  Contact:  Name,  phone  number,  pager 

Assumptions:  example:  facility  operations  and  personnel  availability  are  normal 

Goal(s):  develop  a  patch  to  allow  continued  operations  in  degraded  mode  until  remediation  effort  is  complete. 

Patch  must  be  installed  no  later  than  date. 

Expected  Change  in  Impact  if  Contingency  Plan  Is  Implemented: 

Expected  Duration  of  Plan: 

Maximum  Duration  of  Plan: 


Contingency  Actions  and  Requirements: 


Action 

Resources 
Required* 

Procedures/ 

Materials 

Required 

Training/ 

Drills 

Required 

Lead 
Time 
Req'd 

Est. 
Cost  to 
Prepare 

Est. 
Cost  to 
Perform 

Notify  xxx 

Perform  yyy 

Recover  data  bv  zzz 

Terminate  contingency  plan  by 
www 

Staffing,  equipment,  facilities,  supplies,  communications 


Total  Cost  to  Prepare  for  Contingency  Plan  Implementation  (materials  development,  training,  new  contracts): 
Total  Cost  to  Implement  Plan  (for  expected  duration  of  plan): 
#  Business  Days  Required  to  Implement: 

Possible  Constraints:  Example:  vendor  required  for  step  #  may  have  a  backlog. 
Date  Procedures/Materials  Completed: 
Date  Training/Drills  Completed: 
Date  Contingency  Plan  Tested: 

Other  Contingency  Plans  Related  to  This  Risk:  (provide  references) 

Other  Comments:  If  additional  documentation  for  this  plan  is  available  (e.g.,  a  detailed  plan,  written  procedures  or 
training  materials),  include  the  reference  here. 

Note:  Complex  contingency  plans  will  require  more  detailed  documentation. 
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6.1.2  References 

This  contingency  plan  is  fully  specified  in  "title  of  contingency  plan  document ".  (See  the  PKiO 's  Year  2000 
Contingency  Plan  template.) 

6.1.3  Recovery  Actions 

Use  this  section  as  necessary  to  fully  specify  how  the  agency  will  return  to  normal  operations  after  the 
implementation  of  this  contingency  plan.  Remember  that  the  people  responding  to  the  contingency  scenario  may 
not  ha\'e  been  involved  in  the  development  of  the  contingency  plan  or  the  business  continuity  plan. 

The  format  for  this  section  will  vary  according  to  the  types  of  actions.  For  example,  in  some  cases  a  detailed  or 
annotated  list  of  actions  is  appropriate.  In  other  cases  a  project  plan  may  more  useful. 

6.2.    Contingency  Plan  B 
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Agency  X 
Year  2000  Contingency  Plan  for 

System  ABC  -  Scenario  Q 


Revision  #.# 
Date: 


Signature  of  Agency  Year  2000  Project  Coordinator  Date 


Signature  of  Agency  Head  Date 


Signature  of  Cabinet  Secretary  Date 
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Agency  X 
Year  2000  Contingency  Plan  for 
System  ABC  -  Scenario  Q 

Preface 

This  template  envisions  the  contingency  plan  as  a  relatively  short  document  used  to  specify  a  specific  set  of 
actions  to  be  implemented  in  response  to  a  Year  2000  hazard. 

The  template  is  appropriate  for  contingency  planning  required  to  support  business  continuity  and  for  Year 
2000  remediation  projects.  (See  the  definition  of  Contingency  Plan  provided  in  the  Terminology  section 
below.) 

The  document  is  not  intended  to  repeat  in  detail  the  agency 's  mission,  its  strategy  for  risk  management  and 
business  continuity  planning,  or  a  the  goals  of  a  Year  2000  remediation  project.  The  agency  should  have 
other  documentation  for  those  issues. 

The  Commonwealth  of  Massachusetts,  Year  2000  Program  Management  Office  has  developed  this  Year 
2000  Contingency  Plan  Template  to  facilitate  efforts  of  Commonwealth  agencies  engaged  in  Year  2000 
contingency  planning.  The  template  is  intended  primarily  for  Agencies  that  have  not  previously  performed 
formal  contingency  planning,  but  other  agencies  may  find  the  approach  helpful. 

The  template  can  be  completed  in  a  phased  approach  as  the  risk  management  or  business  continuity 
planning  team  performs  the  following  activities: 

•  Hazard  identification 

•  Business  continuity 

•  Identifying  the  agency 's  primary  services 

•  Determining  operation  priorities  and  minimum  acceptable  service  levels 

•  Determining  potential  system  failure  modes 

•  The  system  is  able  to  process  non-date  sensitive  information 

•  The  system  produces  results  with  incorrect  but  acceptable  errors 

•  The  system  generates  unreliable  and/or  unpredictable  results 

•  The  system  will  not  function 

•  Identifying  the  business  dependencies  for  each  service,  e.g.,  IT  systems,  embedded 
devices,  external  service  providers,  suppliers,  key  personnel,  specific  facilities 

•  Identifying  additional  Year  2000  hazards  to  each  service,  e.g. ,  power  surges/outages, 
disruptions  to  transportation  and  communications  infrastructure 

•  Risk  management  for  Year  2000  projects 

•  Identifying  the  value  of  the  project  to  the  agency  and  which  requirements  or  objectives 
are  mission  critical 

•  Determining  priorities  for  requirements  or  objectives 

•  Identifying  the  dependencies  for  each  major  milestone  used  to  track  progress  on 
completing  a  requirement  or  objective 

•  Identifying  additional  Year  2000  hazards 

•  Analysis 

•  Assessing  the  various  hazards  and  identifying  contingency  options 

•  Assessing  existing  business  continuity  and  disaster  recovery  plans 

•  Evaluating  and  selecting  contingency  options  to  develop,  including  estimation  of  resources 
and  development  schedule 

•  Recommending  additional  preparedness  activities  to  the  Year  2000  project  nianager(s) 

•  Development 

•  Assigning  personnel  to  develop  contingency  plans 
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•  Developing  and  documenting  contingency  plans,  including  all  related  materials  and 
preliminary  activities 

•  Reviewing  contingency  plans 
•     Final  Preparation 

•  Testing  training,  and  practicing  contingency  plans 

•  Assigning  personnel  to  implement  contingency  plans 

The  template  contains  generic  references  like  "Agency  X"  which  each  agency  is  expected  to  replace  with 
agencv-specific  references.  The  template  also  contains  numerous  examples  and  explanatory  comments  to 
advise  how  certain  sections  should  be  completed.  These  sections  are  clearly  marked  using  shaded,  blue 
text  in  italics  and  should  be  deleted  or  replaced  for  the  final  version  of  the  document.  Agencies  are 
expected  to  further  tailor  the  template  as  required  to  meet  internal  standards  or  other  agency  objectives. 

Terminology: 

The  terminology  used  in  discussions  of  risk  management  and  business  continuity  planning  often  varies  from 
source  to  source  or  seems  vague.  The  Commonwealth  of  Massachusetts,  Year  2000  Program  Management 
Office,  is  using  the  following  terminology: 

Risk 

Fully  specified,  a  risk  statement  has  3  parts: 

•  The  risk  condition  or  event  or  hazard 

•  The  probability  of  the  hazard 

•  The  impact  of  the  hazard 

Risk,  as  it  applies  to  Year  2000,  can  be  defined  as  the  probability  a  Commonwealth  agency  will 
experience  an  interruption  or  failure  to  provide  critical  services  to  citizens  due  to  Y2K  problems. 
The  impacts  associated  with  Year  2000  risks  are  typically  measured  in  terms  of  financial  cost  to 
the  agency  or  expense  to  taxpayers,  but  some  can  be  measured  in  terms  of  loss  of  credibility. 

Risks  should  also  be  identified  for  Year  2000  projects.  A  Year  2000  project  risk  is  the  probability 
that  a  project  fails  to  meet  one  or  more  of  its  objectives,  such  as  its  major  schedule  milestones. 
The  impact  of  the  failure  is  usually  measured  in  terms  of financial  cost  to  the  agency  but  items  like 
staff  morale  and  impact  on  other  agency  activities  and  priorities  should  also  be  considered. 

Hazard  (or  Source  of  Risk) 

Hazards  or  sources  of  risk  can  be  categorized  as  internal  or  external.  Internal  Year  2000  hazards 
include  potential  problem  areas  like  the  following: 

•  Technical 

•  Incomplete/inaccurate  inventory/assessment  of  IT  systems  and  embedded  devices 

•  Scope 

•  Complexity 

•  Failure  dates 

•  Defects  created  during  remediation  and  testing  phases 

•  Inadequate  system  documentation 

•  Impaired  interoperability  with  remediated  third-party  products 

•  Nonfunctioning  or  data-altering  interfaces 

•  Undetected  errors 

•  Inability  to  detect  errors  in  timely  manner 

•  Project 
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•  Inadequate  support  from  executive  management 

•  Optimism,  denial,  or  insensitivity  to  risks 

•  Inadequate  estimates  of  resource  requirements 

•  Loss/unavailability  of  key  personnel 

•  Inadequate  remediation  or  test  environment 

•  Staff  expertise 

•  Staff  turnover 

•  Schedule  delays 

•  Ramp  up  time  for  new  staff 

•  Learning  curve  for  new  tools,  methods 

•  Delays  in  project  dependencies 

•  Unforeseen  problems 

•  Inadequate  estimates  of  budget  requirements 

•  Inadequate  funding 

•  Legal 

•  Payment  terms  and  conditions 

•  Year  2000  warranties 

•  License  agreement 

•  Litigation 

External  hazards  includes  items  like: 

•  Vendors 

•  Inaccurate  or  ambiguous  compliance  information 

•  Inability  to  develop  a  compliant  version  of  the  product 

•  Insufficient  testing  of  compliant  versions  of  the  product 

•  Delays  in  developing  compliant  version  of  the  product 

•  Delay  in  shipping  compliant  version  of  the  product  due  to  backlog 

•  Ability  to  stay  in  business  to  address  any  new  compliance  issues 

•  Suppliers  and  Service  Providers 

•  Ability  to  deliver  in  a  timely  manner 

•  Ability  to  stay  in  business 

•  Data  exchange  partners 

•  Erroneous  assumptions  about  shared  file  structures 

•  Delivery  of  corrupted  data 

•  Coordination 

Risk  Management 

Risk  management  is  the  process  an  agency  employs  to  proactively  monitor  Year  2000  risks  and  to 
implement  risk  mitigation  activities.  This  process  is  intended  to  ensure  maximum  preparedness 
for  problems  that  may  occur  at  the  century  changeover.  Risk  management  includes  the  following 
key  steps: 

•  Risk  identification. 

•  Risk  assessment 

•  Determination  of  risk  mitigation  options 

•  Risk  mitigation 

•  Tracking  progress  and 

•  Repeating  the  process 

Risk  Identification 
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The  purpose  of  risk  identification  is  to  list  the  possible  Year  2000 failures  or  hazards.  This 
activity  is  often  performed  by  examining  the  various  sources  of  risks  (see  "Hazard"  above). 

Risk  Assessment 

During  risk  assessment,  hazards  are  analyzed  to  determine: 

•  The  cost/impact,  and 

•  The  estimated  probability  the  event  will  occur. 

At  the  conclusion  of  this  step,  the  risks  are  prioritized  for  risk  mitigation. 

Risk  Mitigation 

Risk  mitigation  is  the  action  or  set  of  actions  put  in  place  specifically  to  reduce  (I)  the  probability 
that  a  risk  will  occur  or  (2)  the  cost/impact  of  a  risk.  Year  2000  remediation  projects  for  mission 
critical  and  essential  systems  are  efforts  intended  to  reduce  the  probability  of  Year  2000  risks, 
while  the  goal  of  contingency  planning  is  primarily  to  reduce  the  impact  of  a  Year  2000 failure. 

Risk  mitigation  activities  can  also  be  classified  as: 

•  Preparedness  activities  for  efforts  initiated  and  completed  prior  to  expected  failure  dates 
includes  actions  like: 

•  Involvement  of  executive  management  to  ensure  remediation  efforts  are  scheduled 
and  performed  in  accordance  with  business  priorities 

•  Development  of procedures  to  recognize  degradation  of  system  functions 

•  Development  of  methods  to  preserve  and  protect  system  data 

•  Development  of  methods  to  detect  and  correct  corrupt  data 

•  Staffing  plans  and  incentives  for  personnel 

•  Independent  Verification  and  Validation 

•  Year  2000  awareness  programs  for  end-users 

•  Dwelopment  of  Year  2000  business  continuity  plans 

•  Business  continuity  and  contingency  plans  for  efforts  that  will  be  initiated  in  response  to 
Year  2000  trigger  events 

Contingency  Plan 

With  respect  to  business  operations,  a  contingency  plan  specifies  an  alternative  approach  for 
providing  a  service  or  fulfilling  a  function  that  can  be  put  into  effect  if  a  Year  2000  event  occurs 
that  significantly  disrupts  normal  operations.  Contingency  plans  are  the  primary  products  of  Year 
2000  business  continuity  planning  efforts.  For  example,  a  contingency  plan  for  performing 
services  out  of  Site  A  if  Site  B  is  unavailable.  Contingency  plans  developed  for  business  continuity 
plans  tend  to  fall  into  3  categories: 

•  Emergency  response 

•  Primary  contingency 

•  Long-term  contingency 

Contingency  plans  can  also  be  part  of  a  Year  2000  preparedness  effort.  For  example,  a  Year 
2000  project  team  that  has  a  very  aggressive  schedule  for  remediating  a  legacy  system  m  ay- 
require  a  contingency  plan  to  develop  a  patch  for  the  production  system  if  the  remediation  effort 
fails  to  meet  a  certain  milestone  by  a  specified  date.  This  contingency  plan  is  properly  a  part  of 
the  remediation  effort  rather  than  the  business  continuity  planning  effort. 
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An  event  that  indicates  implementation  of  a  contingency  plan  may  be  required.  A  trigger 
requiring  an  emergency  response  is  often  the  occurrence  of  a  hazard.  A  trigger  for  a  primary 
contingency  plan  may  be  the  inability  of  the  maintenance  team  to  correct  a  defect  within  24  hours 
of  a  system  failure.  A  trigger  for  a  long-term  contingency  plan  could  be  the  occurrence  of  one  or 
more  hazards  that  indicate  normal  operations  cannot  be  restored  for  an  indefinite  amount  of  time. 


Business  Continuity  Planning 

The  goal  of  business  continuity  planning  is  to  develop  a  set  of  interim  business  processes  that  will 
protect  business  interests  during  an  operational  discontinuity.  Year  2000  business  continuity 
planning  includes  activities  to: 

•  Identijy  and  evaluate  likely  Year  2000  events  that  may  occur  in  spite  of  all  previously 
defined  Year  2000  preparations 

•  Develop  contingency  plans  that  the  agency  will  put  in  place  in  response  to  a  Year  2000 
event 

•  Develop  recovery  plans  for  the  return  to  normal  operations  after  the  need  for  the 
contingency  action  has  passed. 

Business  continuity  plans  must  consider  health  and  safety,  customer  services  and  deliveries, 
access  to  supplies,  and  business  operations.  They  must  describe  the  actions  the  agency  will  take 
to  ensure  continuity  of  core  business  processes. 

For  a  certain  set  of  Year  2000  events,  the  appropriate  Year  2000  business  continuity  plan  will 
mirror  the  agency 's  general  business  continuity  (or  disaster  recovery)  plan.  For  other  Year  2000 
events,  an  existing  disaster  recovery  plan  offers  no  solution  because  the  cause  of  the  event  will 
also  exist  at  the  hot  site  or  on  the  backup  de\> ice/software. 

In  this  document,  Year  2000  business  continuity  planning  is  viewed  as  an  integral  part  of  the  Year 
2000  risk  management  program,  rather  than  an  adjunct  to  general  business  continuity  (or  disaster 
recovery)  planning  since: 

•  The  staff  performing  Year  2000  business  continuity  planning  often  includes  a  significant 
portion  of  the  staff performing  the  more  general  Year  2000  risk  management  program. 

•  Status  of  existing  Year  2000  projects  will  impact  the  identification  and  e\>aluation  of 
likely  Year  2000  events  being  considered  for  business  continuity  planning. 

•  The  business  continuity  activities  to  identify  and  evaluate  likely  Year  2000  e\>ents  may 
lead  to  the  identification  of  additional  Year  2000  projects  (or  new  tasks  for  existing  Year 
2000  projects)  that  can  be  launched  immediately  to  reduce  the  probability  of  a  risk. 


1.  Background 

This  section  should  contain  a  paragraph  or  two  that  briefing  describes  the: 

•  Purpose  or  context 

•  Scope,  who  is  required  to  review  and  use  the  document 

•  Status  and  open  issues,  so  that  readers  will  know  if  they  are  reading  the  final  document 

•  Reference  to  any  higher  level  document,  e.g.,  the  business  continuity  plan  or  the  remediation 
project  plan. 

The  next  update  to  this  document  is  scheduled  for  Month,  Year. 

Please  forward  any  comments  on  this  document  to: 
•     Name,  phone,  e-mail  address 
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2.  Overview 

This  section  is  basically  a  completed  form.  The  form  can  also  be  used  separately  during  working  sessions 
to  capture  information  needed  to  evaluate  and  compare  various  contingency  options: 

Date  Last  Revised: 
Date  Last  Reviewed: 
Approved  by: 

Probable  Trigger  Event(s):  Remediation  effort  does  not  meet  Milestone  X  by  date 

Probable  Trigger  Event  Date(s): 

Probability  (<20%,  20-40%,  40-60%,  60-80%,  >80%): 

Description  of  Impact: 

Estimate  of  Financial  (e.g..  loss,  liabilities,  and  fines)  Impact: 

Estimate  of  Intangible  Impact  (l=Very  Low,  2=Low,  3=  Medium,  4=High;  =5  Very  High): 

Expected  Time  to  Implement:  Within  one  day  of  trigger  occurrence 

Agency  Contact  if  trigger  event  occurs:  Name,  phone  number,  pager 
Alternate  Contact:  Name,  phone  number,  pager 

Assumptions:  example:  facility  operations  and  personnel  availability  are  normal 

Goal(s):  develop  a  patch  to  allow  continued  operations  in  degraded  mode  until  remediation  effort  is 

complete.  Patch  must  be  installed  no  later  than  date. 

Expected  Change  in  Impact  if  Contingency  Plan  Is  Implemented: 

Expected  Duration  of  Plan: 

Maximum  Duration  of  Plan: 


Contingency  Action  and  Requirements: 


Action 

Notify  xxx  of  Trigger  Event 

Resources 
Required* 

Procedures/ 

Materials 

Required 

Training/ 

Drills 

Required 

Lead 
Time 
Req'd 

Est. 
Cost  to 
Prepare 

Est. 
Cost  to 
Perform 

Perform  yyy 

Recover  data  by  doing  zzz 

■  ■ 

Terminate  contingency  plan  by 
doing  www 

Staffing,  equipment,  facilities,  supplies,  communications 


Total  Cost  to  Prepare  for  Contingency  Plan  Implementation  (materials  development  training,  new 
contracts): 

Total  Cost  to  Implement  Plan  (for  expected  duration  of  plan): 
#  Business  Days  Required  to  Implement: 

Possible  Constraints:  Example:  vendor  required  for  step  #  may  ha\>e  a  backlog. 
Date  Procedures/Materials  Completed: 
Date  Training/Drills  Completed: 
Date  Contingency  Plan  Tested: 

Other  Contingency  Plans  Related  to  This  Risk:  (provide  references) 

Other  Comments:  If  additional  documentation  for  this  plan  is  available  (e.g.,  training  materials  or  written 
procedures  included  in  another  contingency  plan),  include  the  reference  here. 
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3.  Detailed  Description  of  Contingency  Actions 

Use  this  section  as  necessary  to  fully  specify  each  contingency  action.  Remember  that  the  people  trying 
implement  the  plan  may  not  have  been  involved  in  its  development. 

The  format  for  this  section  will  vary  according  to  the  types  of  actions.  For  example,  in  some  cases  a 
detailed  or  annotated  list  of  actions  is  appropriate.  In  other  cases  a  project  plan  may  more  useful. 


4.  Procedures  and  Materials 


Use  this  section  as  a  repository  for  materials  require  for  the  various  contingency  actions. 
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Independent  Verification  and  Validation  (IV&  V) 


Mission  Critical  agencies  of  the  Commonwealth  are  being  asked  to  perform  Independent  Verification  and  Validation 
(IV&V)  on  their  mission  critical  systems. 

As  defined,  IV&V  is  the  verification  and  validation  processes  performed  by  an  organization  with  a  specified  degree 
of  technical,  managerial,  and  financial  independence  from  the  development  organization.  "Verification"  is  defined 
as  confirmation  by  examination  and  provision  of  objective  evidence  that  specified  requirements  have  been  fulfilled. 
"Validation"  is  defined  as  the  confirmation  by  examination  and  provision  of  objective  evidence  that  the  particular 
requirements  for  a  specific  intended  use  are  fulfilled.  The  working  definition  used  by  the  Department  of  Labor  is 
that  "validation"  asks  and  answers  the  question,  "Are  we  doing  the  right  thing?"  while  "verification"  asks  and 
answers  the  question,  "Are  we  doing  the  thing  right?" 

To  assist  agencies  with  their  IV&V  process,  the  Operational  Services  Division  has  contracted  with  a  specific 
grouping  of  vendors  qualified  to  address  the  IV&V  issue  of  Year  2000  compliance.  The  listing  of  those  vendors 
follows: 

IV&V  CONTRACT  AND  VENDOR  INFORMATION 


Y2K  Independent  Verification  &  Validation  Services  Contractors 

Contractor 

MMARS  Vendor 

vUUC 

Contact 

Phone/ 

Copci  tm  i  1  a 
r  d lo  1 1 1 1 1  Ic 

E-Mail  Address/ 

VVCU  wilt?  MUUIcga 

CBE  Technologies 

50  Redfield  Street 

DOSIOM,  IVIM  UZ  I  ZZ 

043267622  0001 

Warren  Nelson 

617-265-4000  X230 
Fax:  617-265-2854 

warren@cbetech.com 
www.cbetech.com 

CTA  Commercial  Systems,  Inc. 

6903  Rockledge  Road,  Suite  800 

Rpthp<;Ha  M^rvlanH  ?DR1  7 

840797618  0013 

Paul  Barboza 

301-581-3204 

pbarboza@cta.com 
www.cta.com 

DSD  Laboratories,  Inc. 

75  Union  Street 
Sudbury,  MA  01776 

042659094  0001 

Michael  Sicuranza 

978-443-9700 
Fax:  978-443-9738 

mas@dsdlabs.com 
www.dsdlabs.com 

Farrington  Associates,  Inc. 

460  Totten  Pond  Rd 
Waltham,  MA  02451 

043233597  0001 

Thomas  Farrington 

781-487-7054 
Fax:  781-487-7444 

tfarrington@fainc.com 
www.fainc.com 

Intermetrics,  Inc. 

23  Fourth  Avenue 
Burlington,  MA  01803 

042448936  0009 

Richard  Prussman 

781-221-6990 
Fax:  781-221-6991 

prussman@inmet.co 
m 

www.intermethcs.com 

Vikor  (formerly  Mehta  Corporation) 
175  Cabot  Street,  Suite  420 
Lowell,  MA  01854 

043141660  0008 

Bob  Sharp 

978-275-0532 
Fax:  978-275-0505 

rsharp@vikor.com 
www.vikor.com 

New  Horizons  Software,  Inc. 

128  Warren  Street 
Lowell,  MA  01852 

043238841  0008 

Robert  LeFaiver 

978-934-9193 
Fax:  978-934-9176 

lefaiver@icpl.com 
www.nhsijava.com 

Renaissance  Worldwide 

225  Franklin  Street,  17,h  Floor 
Boston,  MA  02110 

042920563  0003 

Ted  Lyon 

617-338-9119 
Fax:617-210-8188 

tlyon@rens.com 
www.rens.com 

Sumaria  Systems,  Inc. 

99  Rosewood  Drive 
Danvers,  MA  01923 

042770369  0002 

Chandu  Shah 

978-739-4200 
Fax:  978-739-4950 

cshah@sumaria.com 
www.sumaria.com 

Systems  Resources  Corporation 

128  Wheeler  Road 
Burlington,  MA  01803 

042889762  0006 

Denis  Granville 

781-270-9228 

denis.granville@srcor 
p.  com 

www.srcorp.com 

Titan  Software  Systems 

1115  Elkton  Drive,  Suite  200 
Colorado  Springs,  CO  80907 

943284583  0002 

Thomas  Konchan 

719-528-1800 

tkonchan@titan.com 
www.cst.titan.com 

For  additional  information  regarding  IV&V  Vendors,  please  see  OSD  update  #99-28 
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□  CONTRACTOR  AUTHORIZED  SIGNATURE  VERIFICATION  FORM 

□  AFFIRMATIVE  ACTION  PLAN  FORM 

NOTE:  The  partial  list  of  Attachments  referenced  above  in  the  "Attachment  E,  Checklist  Summary"  are 
attainable  through  Comm-PASS  @  www.comm-pass.com 


ATTACHMENT  A 
ATTACHMENT  B 
ATTACHMENT  C 
ATTACHMENT  D 
ATTACHMENT  E 
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RFR  TRANSMITTAL  LETTER 

To:  Interested  Vendors 

From:  Marcia  R.  King,  Procurement  Team  Leader  (PTL),  Independent  Verification  &  Validation 

Date:  06/10/98 

Subject:  INDEPENDENT  VERIFICATION  AND  VALIDATION  -  ITS04  

The  Independent  Verification  &  Validation  Procurement  Management  Team  (IW  PMT  or  PMT)  is  issuing 
this  RFR  as  a  procurement  mechanism  for  all  government  entities  in  the  Commonwealth  of 
Massachusetts. 

The  statewide  master  services  agreement  will  be  awarded  to  multiple  Independent  Verification  & 
Validation  Bidders  to  provide  a  combination  of  best  value  and  technical  ability  on  Year  2000  Independent 
Verification  &  Validation  services.  The  selected  Bidders  may  be  contracted  to  provide  additional  services 
including,  but  not  limited  to,  assessment  plans,  risk  management  assessment  and  department  Y2K 
summary. 

The  schedule  of  events  for  this  solicitation,  subject  to  amendment  by  the  PMT,  is: 


EVENT 

DATE 

TIME 

Open  Solicitation  Announcement  in  Comm-PASS 

06/10/98 

Release  of  RFR  to  Comm-PASS 

06/10/98 

3:00  PM 

Bidder's  Conference 

06/19/98 

10:00  AM 

Bidder's  Written  Questions  Due  Date 

Vr£           if*:-".'  ■ 

06/26/98 

3:00  PM 

IW  PMT  Answers  to  Bidder's  Questions 

mm  ^P" 

(Thurs.) 

07/02/98 

3:00  PM 

Initial  RFR  Response  Open  Date 

(Fri.) 

07/10/98 

3:00  PM 

Initial  RFR  Response  Close  Date 

(Fit) 

07/24/98 

3:00  PM 

Completion  of  Evaluations  (estimated) 

(Fri.) 

07/3198 

(First  Awards  Issued) 

All  notifications,  releases,  and  amendments  to  this  RFR  will  utilize  the  Commonwealth  Procurement 
Access  &  Solicitation  System  (Comm-PASS).  Visit  on  the  Internet  at:  http://www.comm-pass.com/  or 
contact  Comm-Pass  via  phone:  1-888-Ma  State  (  888-627-8283)  E-mail:  Comm-Pass@state.ma.us. 
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PART  1  -  RFR  GENERAL  INFORMATION  AND  MANDATORY  TERMS 
AND  CONDITIONS 

1 .0  PURPOSE  OF  THE  PROCUREMENT 

The  Independent  Verification  and  Validation  Procurement  Management  Team  (IW  PMT  or  PMT)  is 
issuing  this  RFR  as  a  procurement  mechanism  for  government  entities  in  the  Commonwealth. 

1.1  GENERAL  INFORMATION 

1.1.1  The  terms  of  801  CMR  21.00:  Procurement  of  Commodities  and  Services  are  incorporated 
by  Reference  into  this  RFR.  Words  used  in  this  RFR  shall  have  the  meanings  defined  in  801 
CMR  21.00.  Additional  definitions  may  also  be  identified  in  this  RFR.  All  terms,  conditions, 
requirements,  and  procedures  included  in  this  RFR  must  be  met  for  a  Response  to  be  determined 
responsive.  If  a  Bidder  fails  to  meet  any  material  term,  condition,  requirement  or  procedure,  its 
RFR  Response  may  be  deemed  unresponsive  and  disqualified.  The  Bidder  should  note  that  the 
RFR  contains  two  (2)  different  types  of  RFR  specification  language: 

1.1.1.1  If  the  RFR  section  is  prefaced  with  language  such  as:  "shall,"  "will,"  "will  not,"  "may 
not,"  "can  only,"  "prohibited,"  "must,"  and  "required,"  the  Bidder  will  consider  the 
section  to  be  "mandatory,"  or  in  other  words  critical  for  meeting  the  basic  requirements  to 
be  considered  for  a  statewide  contract  as  the  Selected  Bidders. 

1.1.1.2  If  the  RFR  section  is  prefaced  with  language  such  as*:  "may,"  "could,"  "suggested," 
and  "requested,"  the  Bidder  will  consider  the  section  to  be  "desirable,"  or  in  other  words 
optional  for  Bidder  to  respond  to  the  statewide  .contract. 

1.1.2  Unless  otherwise  specified  in  this  RFR,  all  communicaUons,  Responses,  and  documentation  must 
be  in  English,  all  measurements  must  Jje^rovldeclnn  feet,  inches,  and  pounds  and  all  cost 
proposals  or  figures  must  be  in  U.S.  Currency.  All  Responses  must  be  submitted  in  accordance 
with  the  specific  terms  of  this  RFR..  Efectronic  Besporises  may  not  be  submitted  in  response  to 
this  RFR.  :  '  ,r 

1.1.3  Concerning  this  RFR,  Bidders  are  prohibited  from  communicating  directly  with  any  member  of 
the  PMT  except  as  specified  in.this  RFR,  and  no  other  individual  Commonwealth  employee  or 
representative  is  authorized  to  provide  any  information  or  respond  to  any  question  or  inquiry. 
Bidders  may  contact  the  Procurement  Team  teader  (reference  RFR  Section  1.6.1)  or  designee 
for  this  RFR  in  the  event  this  RFR  is  incomplete  or  the  Bidder  is  having  trouble  obtaining  any 
required  attachments  electronically  through  Comm-PASS. 

1.1.4  The  Procurement  Team  Leader  (PTL)  may  provide  reasonable  accommodations,  including  the 
provision  of  informational  material  in  an  alternative  format,  for  qualified  Bidders  with  disabilities  or 
other  hardships.  Bidders  requiring  accommodation  shall  submit  requests  in  writing,  with 
supporting  documentation  justifying  the  accommodation,  to  the  PTL.  The  PTL  reserves  the  right 
to  grant  or  reject  any  request  for  accommodation. 

1.1.5  All  Responses  and  information  submitted  in  response  to  this  RFR  are  subject  to  the 
Massachusetts  Freedom  of  Information  Law,  M.G.L.,  Chapter  66,  Section  10,  and  to  Chapter  4, 
Section  7,  Subsection  26,  regarding  public  access  to  such  documents.  Any  statements  which 
reserve  confidentiality  or  privacy  rights  in  submitted  Responses,  or  are  otherwise  inconsistent  with 
these  statutes,  will  be  void  and  disregarded. 

1.1.6  The  Commonwealth  makes  no  guarantee  that  any  commodities  or  services  will  be  purchased 
from  any  Contract  resulting  from  this  RFR.  Any  estimates  or  past  procurement  volumes 
referenced  in  this  RFR  are  included  only  for  the  convenience  of  Bidders,  and  are  not  to  be  relied 
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upon  as  any  indication  of  future  purchase  levels.  The  Commonwealth  does  not  guarantee  any 
minimum  quantity  of  purchases  from  any  Contract  resulting  from  this  RFR. 


1.1.7  Unless  otherwise  clearly  stated  in  this  RFR,  any  reference  to  a  particular  trademark,  trade  name, 
patent,  design,  type,  specification,  producer  or  supplier  is  not  intertded  to  restrict  this  RFR  to  any 
manufacturer  or  proprietor  or  to  constitute  an  endorsement  of  any  good  or  service.  The  I W  PMT 
may  consider  clearly  identified  offers  of  substantially  equivalent  goods  and  services  submitted  in 
response  to  such  reference. 

1.1.8  If  a  Bidder  is  unable  to  meet  any  of  the  specifications  required  in  this  RFR,  the  Bidder's  Response 
must  include  an  alternative  method  for  meeting  such  specification  by  identifying  the  specification, 
the  proposed  alternative  and  thoroughly  describing  how  the  alternative  achieves  substantially 
equivalent  or  better  performance  to  the  performance  required  in  the  RFR  specification.  The  IW 
PMT  will  determine  if  a  proposed  alternative  method  of  performance  achieves  substantially 
equivalent  or  better  performance.  The  determination  of  the  IW  PMT  on  the  Bidder's  proposed 
alternative  method  will  be  final. 

1.1.9  The  goal  of  this  RFR  is  to  provide  the  best  value  of  commodities  and  services  to  achieve  the 
procurement  goals  of  the  IW  PMT.  Bidders  proposing  alternatives  which  provide  substantially 
better  or  more  cost-effective  performance  than  achievable  under  a  stated  RFR  specification  or 
Bidders  that  propose  discounts,  uncharged  commodities  and  services  or  other  benefits  in  addition 
to  the  RFR  specifications  may  receive  a  preference  or  additional  points  under  this  RFR  as 
specified.  * 

1.1.10  The  IW  PMT  and  a  selected  Bidder  may  negotiate  eithe^^urip^  a  renewal  period  or  as  business 
conditions  require,  a  change  in  any  element  of  Co^r^^^^rmance  or  cost  identified  in  the 
original  RFR  or  the  selected  Bidder's  or  Contrac^^fsfe  Response  which  results  in  lower  costs 
or  better  value  than  was  presented  in  the  ^edted- Bidder's  "or  Contractor's  original  RFR 
Response.  .  f$f|fe. 

1.1.11  All  Responses  must  be  presented, using  the  same  numbering  and  ordering  sequence  used  in  this 
RFR  or  as  otherwise  specified,?'-''*  „a.,J 

Hi- * 

1.1.12  Costs  which  are  not  specifically  identified  in  the  Bidder's  Response,  and  included  in  the  resulting 
Contract,  will  not  be  compensated,,  the  Commonwealth  will  not  be  responsible  for  any  costs  or 
expenses  incurred  by  Bidders  responding  to  this  RFR. 

1.1.13  If  this  RFR  has  been  distributed  electronically  using  the  Comm-PASS  system,  it  shall  be  the 
responsibility  of  every  Bidder  to  check  Comm-PASS  for  any  addenda  or  modifications  to  this  RFR. 
The  Commonwealth  and  its  subdivisions  accept  no  liability  and  will  provide  no  accommodation  to 
Bidders  who  fail  to  check  for  amended  RFRs  and  submit  inadequate  or  incorrect  Responses. 
Potential  Bidders  are  advised  to  check  the  "last  change"  field  on  the  summary  page  of  RFRs  for 
which  they  intend  to  submit  a  Response  to  ensure  that  they  have  the  most  recent  RFR  files. 

1.1.14  Bidders  may  not  alter  (manually  or  electronically)  the  RFR  language  or  any  RFR  component  files. 
Modifications  to  the  body  of  this  RFR,  its  specifications,  terms  or  conditions,  especially  those 
which  change  the  intent  of  this  RFR,  are  prohibited.  Any  unauthorized  modifications  may 
disqualify  a  Response. 

1 .2       COMMONWEALTH  TERMS  AND  CONDITIONS  &  STANDARD  CONTRACT  FORM 


All  Bidders  will  be  required  to  complete,  execute  and  return  the  following  two  (2)  documents: 

1 .  The  Commonwealth  Terms  and  Conditions.  If  the  Bidder  has  already  executed  and  filed 
the  Commonwealth  Terms  and  Conditions,  please  indicate  this  in  your  Response.  The 
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Commonwealth  Terms  and  Conditions  shall  be  incorporated  by  reference  into  any  Contract 
for  commodities  and  services  executed  pursuant  to  this  RFR.  A  Bidder  is  required  to  execute 
the  Commonwealth  Terms  and  Conditions  only  once. 

2    The  Standard  Contract  Form  as  follows: 

 X  (a)  included  in  the  Bidder's  RFR  Response.   Failure  to  return  a  completed  and 

executed  Standard  Contract  Form  will  disqualify  the  Bidder's  Response. 
 (b)  upon  selection  for  Contract  negotiation  and  execution. 

By  executing  the  Standard  Contract  Form,  the  Contractor  certifies  under  the  pains  and 
penalties  of  perjury  that  it  has  submitted  a  Response  to  a  Request  for  Response  (RFR) 
issued  by  the  IW  PMT  and  that  this  Response  is  the  Contractor's  offer  as  evidenced  by  the 
execution  by  the  Contractor's  authorized  signatory,  that  the  Contractor's  Response  may  be 
subject  to  negotiation  by  the  IW  PMT,  and  that  the  terms  of  the  RFR,  the  Contractor's 
Response  and  any  negotiated  terms  shall  be  deemed  accepted  by  the  IW  PMT  and  included 
as  part  of  the  Contract  upon  execution  of  the  Standard  Contract  Form  by  the  Purchasing 
Agent,  as  authorized  signatory. 

1.3  ELIGIBLE  GOVERNMENT  ENTITIES 

This  statewide  Contract  may  be  used  by  all  agencies  of  the  Commonwealth  of  Massachusetts, 
including  all  Constitutional  Offices,  the  Legislature,  the  Judiciary,  Elected  Offices,  Public 
Institutions  of  Higher  Education,  the  Military  Division  and  Independent  Public  Authorities,  and  all 
other  political  subdivisions  of  the  Commonwealth  including  cl|es,  towns,  municipalities,  county 
governments,  school  districts  and  other  service  district^ Tajid!||uasi-public  agencies.  In  addition, 
not-for-profit  vendors  currently  providing  human  and  sqciaTseTVices  to  the  Commonwealth  under 
contract,  and  other  entities  designated  in  writing  .by  the  State^gurchasing  Agent  may  use  this 
statewide  Contract. 

1.4  CONTRACT  TERM 

1.4.1  Initial  Term  -  The  initial  term  of  the  contract  resulting  from  the  IW  RFR  is  anticipated  to  start  on 
the  effective  date  of  the  Contract  and  continue  through  June  30,  2000. 

1.4.2  Extensions  -  For  the  Commonwealth  of  Massachusetts,  the  contract  will  include  one  (1)  optional 
12-month  extension  based  upon  the  Bidder's  performance,  cost  and  business  conditions. 

1.4.3  Multiple  Contractors  -  The  Procurement  Team  Leader,  in  consultation  with  the  IW  PMT  may 
elect  to,  after  the  Initial  RFR  Response  Date,  entertain  additional  Bidders  proposals  on  a  quarterly 
basis  (10/98,  01/99,  03/99,  06/99).  In  that  event  that  additional  bidder(s)  are  selected,  the 
Contract  duration  for  the  additional  bidder(s)  will  run  concurrently  with  the  other  Contractor(s)  on 
the  IW  Contract. 

1 .5  CONTRACTUAL  ORDER  OF  PRECEDENCE 

The  selected  Bidders  will  establish  with  the  Commonwealth  of  Massachusetts  the  following  order  of 
precedence  in  regard  to  the  execution  of  this  Contract: 

1.  Massachusetts  Terms  and  Conditions; 

2.  Standard  Contract  Form; 

3.  Attachment  D,  Year  2000  Warranty; 

4.  RFR  Issued  by  the  Commonwealth  and  any  subsequent  amendments;  and 

5.  Bidder  Response  Content. 

The  specifications  and  contents  of  the  successful  Bidder's  proposal  will  become  part  of  any  contract 
awarded. 
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1.6       PROCUREMENT  TEAM  LEADER/CONTACT  PERSON 


1.6.1  Marcia  R.  King,  Procurement  Team  Leader  (PTL),  shall  be  the  main  contact  for  any  Contract 
resulting  from  this  RFR.  The  PTL  shall  have  the  final  authority,  with  the  consultation  of  the  IW 
PMT,  in  all  operational  matters  pursuant  to  this  Contract.  The  PT1  must  approve  amendments, 
alterations,  substitutions,  or  modifications  to  this  contract  prior  to  their  implementation.  The  PTL 
will  from  time  to  time  designate  procurement/contractual  responsibilities  in  her  absence. 


Comm-PASS  Internet  Address: 
Purchasing  Department: 
Address: 

Telephone  #: 

E-Mail  or  Internet  Address: 
RFR  File  Name/Title : 
RFR  File  Number: 

Procurement  Team  Leader/Contact: 
Procurement  Team/Category: 


www.comm-pass.com 
Information  Technology  Division 
One  Ashburton  Place,  Rm  801 
Boston,  MA  02108 
617-973-0711 
marcia. king@state. ma.  us 
Independent  Verification  &  Validation 
ITS04 

Marcia  R.  King 
Information  Technology 


1.6.2  Independent  Verification  &  Validation  PMT  -  The  members  of  the  PMT  perform  several 
functions  in  regard  to  this  RFR  and  the  subsequent  Contract  with  the  Bidder.  The  functions  may 
include  but  are  not  limited  to  research,  evaluation,  contract  management/execution  and 
performance  management.  The  PMT  members  are  as  follows:  , 


Ms.  Marcia  King 

Information  Technology  Division 

Mr.  Anthony  DeIG rosso 
Department  of  Revenue 

Mr.  Val  Asbedian 

Information  Technology  Division 

Ms.  Stephanie  Sutliff 
Department  of  Revenue 


Mr.  Gerard  Polcari 
Operational  Services  Division 

Ms.  Susan  Foss 

Office  of  the  State  Comptroller 

Mr.  Richard  Burke 

Department  of  Employment  &  Training 


1.6.2  T.  Louis  Gutierrez,  Chief  Information  Officer  (CIO),  Commonwealth  of  Massachusetts  shall 
have  oversight  for  all  information  technology  purchased  in  the  Commonwealth  of  Massachusetts. 
The  CIO  shall  forward  policy  directives  affecting  the  purchase  of  Year  2000  Independent 
Verification  &  Validation  services  in  the  Commonwealth  of  Massachusetts  pursuant  to  this 
Contract.  The  CIO  and  PTL  will  meet  periodically  on  all  operational,  business,  legal  and  policy 
issues  affecting  the  Year  2000  IW  services  from  this  Contract. 


1.7       ACCOUNT  MANAGER 


Commonwealth  of  Massachusetts  Account  Manager  -The  Bidder  must  provide  in  its  RFR 
Response,  the  name  of  an  individual  who  will  be  the  Account  Manager  for  the  term  of  the  resulting 
Contract  The  Account  Manager  will  be  responsible  for  proper  operation  and  administration  of  the 
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Contract  by  the  Contractor.  The  Account  Manager  shall  respond  in  a  timely  manner  in  writing 
unless  instructed  otherwise,  to  all  information  requests  from  the  PTL  The  Account  Manager  shall, 
upon  request,  attend  meetings  at  the  Information  Technology  Division  (ITD)  or  at  other  sites,  as 
requested  by  the  PTL.  The  Account  Manager  will  be  responsible  for  reports  required  in  this  RFR 
and  to  serve  as  liaison  between  the  Contractor  and  ITD  and  the  eligible  government  entities.  The 
IW  PMT  may  require  the  Contractor  to  relieve  and  replace  the  Account  Manager  if  in  the  IW 
PMTs  opinion  it  appears  th 

•  The  Account  Manager  does  not  perform  at  the  applicable  skill  level  specified  in  the  Contract; 

•  The  Account  Manager  does  not  deliver  work  which  conforms  to  the  performance  standards 
stated  in  the  Contract  and/or 

•  Personality  conflicts  with  the  Account  Manager  hinder  effective  functioning  of  the  Contract. 

1 .8  PRIME  BIDDER  AND  SUBCONTRACTORS ) 

The  Commonwealth  requires  a  single  point  of  contact  resulting  from  this  RFR.  Subcontractors  may  be 
used,  but  the  Prime  Contractor  must  accept  full  responsibility  for  any  subcontractor's  performance. 
Bidders  must  provide  a  list  of  all  subcontractors,  a  description  of  each  subcontractor's  responsibilities  and 
signed  letters  of  agreement  between  the  Bidder,  as  the  Prime  Contractor,  and  its  subcontractor(s) 
identifying  their  responsibilities  and  their  relationship  to  the  Prime  Contractor.  The  Bidder  must  notify  the 
PMT  on  any  subcontractor  changes,  additions  and  deletions  throughout  the  term  of  the  Contract.  The 
PMT  has  the  right  to  approve/reject  any  subcontractors. 

The  Bidder,  as  Prime  Contractor,  shall  be  responsible  for  meeting  all  ofthe  terms  of  any  contract  resulting 
from  this  RFR. 

1.9  INSTRUCTIONS  FOR  SUBMISSION  OF  RFR  RESPONSES  f 

The  Bidder  may  respond  to  the  initial  IW  RFR  solicitation  period  starting  on  Friday,  July  10,  1998  at  3:00 
PM  and  ending  Friday,  July  24,  1998  at  3:0Qpfn.  the  RFR  Response  must  be  sealed,  labeled,  and 
submitted  to  ITD  with  the  following  address  andjRFR  #IT804: 

Ms.  Marcia  R.  King  t 

Procurement  Team  Leader  -  Independent  Verification  &  Validation 
Information  Technology  Division 
One  Ashburton  Place,  Room  801 
Boston,  MA  02108 
Attention:  OSD  RFR  ITS04 

1.9.1  Paper  Submission  -  The  Bidder  must  submit  one  (1)  original  Response  to  the  RFR  and  six  (6) 
copies  on  8  14"  x  11"  paper  in  three  (3)  ring  binders.  Both  the  original  and  copies  must  be 
submitted  on  recycled  paper.  All  RFR  Response  copies  should  be  printed  double-sided. 

1 .9.2  Reduction  of  Non-recyclable  or  Non-reusable  materials  -  The  Bidder  is  requested  to  minimize 
the  use  of  non-recyclable  or  non  re-usable  materials  such  as  plastic  dividers,  vinyl  sleeves  and 
GBC  binding.  Bidders  are  encouraged  to  use  other  products,  which  contain  recycled  content  in 
their  bid  documents.  Such  products  may  include,  but  are  not  limited  to,  folders,  binders,  paper 
clips,  envelopes,  boxes,  etc.  Unnecessary  samples,  attachments,  or  documents  not  specifically 
requested  in  the  RFR  should  not  be  submitted. 

1.9.3  Electronic  Submission  -  The  Bidder  must  submit  7  copies  of  the  RFR  Response  on  3.5" 
diskette.  The  Bidder  must  use  Microsoft®  Word  for  Windows95,  Version  7.0  or  lower  and 
Microsoft®  Excel  for  Windows95,  Version  7.0  or  lower.  All  copies  of  the  electronic  submission 
must  be  identical  to  information  provided  by  the  Bidder  on  the  corresponding  disk(s).  (Reference 
RFR  Section  1.10.1)     In  the  event  of  a  discrepancy  between  a  paper  submission  and 
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electronic  submission  on  disk,  the  paper  submission  will  prevail.  The  Bidder  is  requested 

to  label  all  disks  including  the  following  information:  Bidder  name,  address,  contact  name, 
telephone  number  and  RFR#  ITS04  The  bidder  must  guarantee  that  all  electronic  submissions 
be  virus-free. 

1.9.4    INDEPENDENT  VERIFICATION  AND  VALIDATION  Submission  Matrix  (Attachment  A)  -  The 
Bidder  is  required  to  complete  the  IW  Submission  Matrix. 


1.9.5  Check-off  Summary  -  The  following  check-off  summary  provides  the  required  content  and 
sequential  order  in  which  the  Bidder's  RFR  Response  package  must  be  presented  to  the  IW 
PMT. 


□        Bidder's  Letter  of  Transmittal  -  Cover  letter  with  this  RFR,  signed  by  the  individual  on 
Contractor's  Authorized  Signature  Verification  Form  issued  with  this  RFR.  The  Bidder 
must  clearly  state  that  its  RFR  Response  unconditionally  guarantees  that  all  mandatory 
^  specifications  are  accepted  and  that  the  Response  complies  with  the  IW  requirements. 

The  Bidder  is  requested  to  clearly  state  in  its  RFR  Response  which  specifications  are 
responsive  to  desirable  proposed  goods  and  services.  If  an  alternative  is  proposed,  the 
Bidder  must  identify  the  original  specification  and  alternative  proposal. 


□  Attachment  A  -  Independent  Verification  And  Validation  Submission  Matrix 

□  Bidder's  RFR  Response 

□  Attachment  B  -  RFR  Cost  Tables 

□  Attachment  C  -  Mandatory  Firm  Offer 

□  Attachment  D  -  Year  2000  Warr^iyiCe 


□        Attachment  E  -  Checklist  Summary 

♦  Standard  Commonwealth  Terms  and  Conditions  -  The  Bidder  must  complete 
and  sign  this  contract  according  to  its  preceding  "Instruction"  page.  The 
document  must  be  unconditionally  signed,  and  submitted  without  alteration.  If  the 
provisions  in  this  attachment  are  not  accepted  in  their  entirety  without 
modification,  the  entire  proposal  offered  in  response  to  this  solicitation  may  be 
deemed  non-responsive. 

♦  Standard  Contract  Form  -  By  executing  this  document,  the  Bidder  certifies, 
under  the  pains  and  penalties  of  perjury,  that  it  has  submitted  a  Response  to  this 
RFR  that  is  the  Bidder's  Offer  as  evidenced  by  the  execution  of  its  authorized 
signatory,  and  that  the  Bidder's  Response  may  be  subject  to  negotiation  by  the 
IW  PMT.  Also,  the  terms  of  the  RFR,  the  Bidder's  Response  and  any  negotiated 
terms  shall  be  deemed  accepted  by  the  Operational  Services  Division  and 
included  as  part  of  the  Contract  upon  execution  of  this  document  by  the 
Purchasing  Agent. 


♦  Massachusetts  Substitute  W-9  Form  -  (If  a  Bidder  has  already  submitted  a 
W-9  form  and  has  received  a  valid  Massachusetts  Vendor  Number,  the  W-9 
form  is  not  required).  If  necessary,  the  Bidder  must  complete,  sign,  and 
submit  the  W-9  form.  This  form  is  required  by  the  Office  of  the  Comptroller  for 
Taxation  Reporting  Information  and  is  used  to  assign  or  confirm  a  Massachusetts 
.•Vendor  Number.  A  Contract  cannot  be  executed  without  a  valid  Massachusetts 
Vendor  Number  on  file  with  the  Commonwealth.  Business  enterprises  must 
complete  Employer  Identification  Number  only.  Individuals  who  report  income 
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through  their  Social  Security  Number  must  complete  Social  Security  Number 
only.  The  information  on  this  form  will  be  used  to  record  your  place  of  business 
and  where  payments  under  a  state  contract  will  be  sent. 

♦  Contractor  Authorized  Signature  Verification  Form 

♦  Affirmative  Action  Plan  Form 

□  Certificate  of  Tax  Compliance  -  Bidder  must  certify  compliance  with  all  Federal  and 
Commonwealth  tax  laws,  including  M.G.L.  Chapter  62C  Paragraphs  49A.  The  Bidder 
may  do  this  as  a  certification  statement.  Bidders  that  are  based  in  Massachusetts  or 
derive  an  income  in  Massachusetts  are  encouraged  to  apply  for  a  Certificate  of  Tax 
Standing.  Bidders  should  submit  an  application  to: 

The  Certificate  Unit 

Massachusetts  Department  of  Revenue 
200  Arlington  Street 
P.O.  Box  7066 
Chelsea,  MA  021 14 
(617)  887-6555 

1.10  CANCELLATION  OF  THIS  PROCUREMENT 

The  Commonwealth  may  cancel  this  RFR  at  any  time.  (Reference >^01  CMR  21.06  (7)  Procurement 
Cancellation) 

1 .1 1  CONTRACT  AWARD 

The  PMT  shall  evaluate  all  Bidders'  Responses  rjneeting  the  requirements  of  the  RFR,  and  make  award(s) 
to  the  Bidder(s)  whose  RFR  Response  provides  the  best  value  to  the  Commonwealth.  The  IW  PMT 
reserves  the  right  to  secure  identical  services  from  other  Bidders. 

1.12  NO  GUARANTEE  TO  PURCHASE 

The  Commonwealth  makes  no  guarantee  that  any  purchases  will  take  place  from  any  contract  resulting 
from  this  RFR. 

1.13  EVALUATION  OF  RFR  RESPONSES  AND  AWARD 

1.13.1  Review  of  Bidder  RFR  Responses  -  RFR  Responses  that  are  submitted  during  the  Initial  RFR 
Response  period  (Friday,  July  10,  1998  through  Friday,  July  31,  1998)  and  are  responsive  to  all 
the  requirements  of  the  RFR  will  be  evaluated  against  the  PMT  Evaluation  Criteria.  The  IW  PMT 
will  consider  the  following  evaluation  criteria  during  its  review  of  Bidder's  RFR  specifications: 

•  IW  Specifications; 

•  Business  Specifications; 

•  Cost  Specifications;  and 

•  Performance/Reporting  Requirements. 

1.13.2  Interviews  -  The  IW  PMT  may  invite  Bidders  to  interview  with  the  IW  PMT.  The  interview  will 
include,  but  is  not  limited  to,  a  presentation  from  the  Bidder,  discussion  on  the  Bidder's  RFR 
response,  IW  Past  Work  experience,  and  questions  and  answers. 

1.13.3  Selection  -  The  Commonwealth  intends  to  qualify  multiple  Bidders.  The  IW  PMT  intends  initially 
to  make  a  multiple  awards  to  the  most  responsive  Bidder(s)  that  meet  the  minimum  requirements 
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of  this  RFR  and  Year  2000  IW  services  and  features  that  will  serve  the  best  interests  of  the 
Commonwealth. 

1.13.4  Award  -  The  Commonwealth  will  award  multiple  contracts  to  the  Bidder  whose  RFR  Responses 
that  best  meets  the  requirements  for  price,  value,  and  is  in  the  best  interests  of  the 
Commonwealth. 

1 .14  PROPOSAL  ACCEPTANCE  PERIOD 

The  Bidder's  proposal  must  remain  in  effect  for  at  least  90  calendar  days  from  the  deadline  for 
submission  of  the  proposal. 

1.15  DEFINITIONS 

"American  National  Standards  Institute"  (ANSI)  -  An  organization  that  maintains  standards  on  many 
different  topics.  American  National  Standards  Institute,  11  West  42nd  Street,  New  York,  NY  10036. 

"ANSI  X.1 2.850"  -  ANSI  Purchase  Order  Format 

"Bidder"  -  Selected  Bidders. 

"Commonwealth"  -  Commonwealth  of  Massachusetts. 

"CMR"  -  Code  of  Massachusetts  Regulations.  w 

"Commencement  Date"  -  The  date  on  which  the  programs  are  delivered  by  Selected  Bidders  as 


"Contractor"  -  An  individual  or  organization  that  enters^nto  a  Contract  with  a  Department  or  the 
Commonwealth  of  Massachusetts  to  provide  co|nmoditi|s  or^le/vices  and  is  listed  in  the  MMARS  vendor 
file  (see  following  definition  of  MMARS).  For  the  purposlfbf  trfis  RFR,  "Statewide  Contractor  for  Software 
and  Services"  refers  to  Contractors  selected  to  provide  services  under  contract  Price  Agreement  ITS04 
(Software  License  Purchases);  Master  Service  Agreement  BT8H031  (Software  Services  -  Technical 
Support/Education/Training);  and  BT8L411  (Software  Services  -  Maintenance  and  Upgrades). 

"Desirable"  -  RFR  specifications  prefaced  with  language  such  as:  "may,"  "could,"  "suggested,"  and 
"requested,"  will  be  considered  by  the  Bidder  to  be  "desirable,"  or  in  other  words  optional  for  the  Bidder 
to  respond  to  the  statewide  contract  as  the  Selected  Bidders. 

"Documentation"  -  The  user  guides  and  manuals  for  installation  and  use  of  the  program  software. 
Documentation  is  provided  in  CD-ROM,  diskette,  or  bound  form,  whichever  is  generally  available. 

"Employment  Base"  -  Employees  that  are  taxed  by  the  Commonwealth. 

"Enrolling  Customer"  -  Defined  as  (a)  the  Lead  Customer;  (b)  any  Lead  Customer  Affiliate  and/or 
identifiable  division,  business  unit,  office  location  or  eligible  government  entity  defined  in  RFR  section  1.3 
Eligible  Government  Entities. 

"Evaluation  Software"  -  Fully  functional  software  that  is  distributed  by  the  Selected  Bidders  for  testing, 
evaluation  and  training  purposes.  The  eligible  government  entity  is  not  required  to  return  the  evaluation 
software  and  is  permitted  to  register  the  software  with  the  Selected  Bidders  for  future  upgrades.  The 
evaluation  software  has  no  value  since  the  Selected  Bidders  is  distributing  software  that  is  not  fully 
licensed  and  contains  np  liability  to  the  Selected  Bidders  and  no  warranty  to  the  government  entity. 


ordered. 
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"Fiscal  Year"  -  The  year  beginning  with  July  first  and  ending  with  the  following  June  thirtieth  as  defined  in 
M.G.L  Chapter  4,  Section  7.  This  may  also  be  referred  to  as  the  "State  Fiscal  Year." 

"Internet"  -  In  general,  a  collection  of  networks  connected  to  each  other  using  TCP/IP  technology. 

"Internet  Protocol"  (IP)  -  The  network  layer  for  the  TCP/IP  protocol  suite  widely  used  on  Internet.  IP  is  a 
connection  less,  best-effort  packet  switching  protocol.  It  provides  packet  routing,  fragmentation  and  re- 
assembly through  the  datalink  layer. 

"Independent  Verification  &  Validation"  (IW)  -  IW  is  a  process  to  determine  that  the  requirements  for 
a  project,  be  it  software,  embedded  chip  or  hardware,  are  implemented  correctly  and  completely  and  are 
traceable  to  system  requirements.  Usually  performed  by  an  independent  third  party. 

"Lead  Customer"  -  Commonwealth  of  Massachusetts. 

"Mandatory"  -  RFR  sections  prefaced  with  language  such  as:  "shall,"  "will,"  "will  not,"  "may  not," 
"can  only,"  "prohibited,"  and  "required,"  will  be  consider  by  the  Bidder  to  be  "mandatory,"  or  in  other 
words  critical  for  meeting  the  basic  requirements  to  be  considered  for  a  statewide  contract  as  the  Selected 
Bidders. 

"M.G.L."  -  Massachusetts  General  Laws 

"MMARS"  -  The  Massachusetts  Management  Accounting  and  Reporting  System  established  by  the 
Office  of  the  Comptroller  pursuant  to  M.G.L.  Chapter  7A,  Section  7^AII  payments  to  Contractors  are 
processed  and  recorded  in  MMARS.  Contractors  are  listed  in.  a  vendor  file  in  MMARS  by  their  tax 
identification  number.  ,  ^ 

"Named  User"  -  An  individual  authorized  by  the  customer  to  use  the  programs  on  the  designed  systems, 
regardless  of  who  is  actively  using  the  prog rams.at  any  given  time. 

"Open  Buying  on  the  Internet  (OBI)  Standard"  -  An  Internet  Business  Consortium  to  provide  access  to 
easy-to-use,  open,  standards-based  Internet  purchasing  solutions  for  the  procurement  of  high-volume, 
low-dollar,  indirect  goods  and  services^  The  "Internet  Purchasing  Roundtable"  completed  version  1.0  of 
the  OBI  standard  that  includes  a  generic  set  of  requirements,  an  architecture,  and  an  exact  technical 
specification.  For  additional  information  or  a  copy  of  version  1.0  of  the  OBI  standard,  please  visit  the 
Consortium  Web  Site  at:  http:/www.supplyworks.com/obi  or  soon  to  be  http:Zwww.obi.org 

"Operational  Services  Division  (OSD)"  -  A  Department  of  the  Commonwealth,  within  the  Executive 
Office  for  Administration  and  Finance,  established  pursuant  to  St.  1989,  Chapter  731,  which  is  responsible 
for  the  management  and  oversight  of  procurement  activities  in  the  Commonwealth  of  Massachusetts. 

"Payment  Cycle"  -  The  Commonwealth's  payment  cycle  is  thirty  (30)  calendar  days  from  receipt  of  a 
properly  submitted  invoice  by  the  Statewide  Contractor.  A  Department  or  the  Commonwealth  will  not  incur 
late  penalty  interest  charges  provided  payments  are  issued  within  this  period  but  may  pay  in  a  shorter 
period  to  take  advantage  of  prompt  payment  discounts. 

"Procurement  Management  Team"  (PMT)  -  Representatives  from  various  Departments  that  design 
procurements,  develop  specifications,  conduct  solicitations  and  award  contracts.  The  PMT  also  monitors 
Contractor  performance  and  the  level  of  customer  satisfaction  throughout  the  life  of  the  Contract,  or  may 
delegate  this  effort  at  their  discretion. 

"Program  Office  for  Y2K"  -  The  Y2K  Program  Office  ensures  accurate  monitoring  of  the 
Commonwealth's  progress  in  meeting  the  Year  2000  challenge;  identifing  risk  areas  and  risk  mitigation 
activities;  disseminating  lessons  learned  to  state  agencies;  and  serving  as  a  Year  2000  resource  to  all 
Commonwealth  agencies  and  departments. 
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"Program"  -  The  software  including  media,  documentation  and  updates  distributed  by  the  Selected 
Bidders  for  which  the  government  entity  is  granted  a  license  pursuant  to  this  RFR. 

"Selected  Bidders"  -  Bidder. 

"Transmission  Control  Protocol"  (TCP)  -  A  common  transport  layer  protocol  used  on  the  Internet. 
TCP  is  built  on  top  of  Internet  Protocol  (IP)  and  is  nearly  always  seen  in  the  combination  TCP/IP  (TCP 
over  IP).  It  adds  reliable  communication,  flow-control,  multiplexing  and  connection-oriented 
communication. 

"Update"  -  A  subsequent  release  of  the  Program  which  the  Selected  Bidders  or  Software  Publisher 
generally  makes  available  for  program  licenses  with  or  without  an  additional  license  fee,  provided  that  the 
government  entity  has  ordered  the  appropriate  support  for  such  licenses  for  the  relevant  time  period. 
Update  shall  not  include  any  release,  options  or  future  product  which  Selected  Bidders  or  Software 
Publisher  licenses  separately. 

"Value  Added  Services  and  Features"  -  The  RFR  contains  some  very  specific  procurement  protocols 
and  mandatory  Responses  from  the  Bidder.  The  IW  PMT  has  left  room  for  Selected  Bidders  to 
differentiate  themselves  through  value-added  services  and  features. 

"Year  2000  Compliant"  -  Year  2000  compliant  means  information  technology  that  accurately  processes 
date/time  data  (including,  but  not  limited  to,  calculating,  comparing.^nd  sequencing)  from,  into,  and 
between  the  twentieth  and  twenty-first  centuries,  and  the  years  1999  arjd  2000  and  leap  year  calculations. 
Furthermore,  Year  2000  compliant  information  technology^  when  vused  in  combination  with  other 
information  technology,  shall  accurately  process  date/time^cJata  if  tr|e  other  information  technology 
properly  exchanges  date/time  data  with  it.  b  Jl- 

1.16     SEVERABILITY  is-  % 

If  any  section  of  the  IW  RFR  or  subsequent  contract  is  deemed  to  be  unenforceable  or  not  compliant  with 
the  Laws  of  the  Commonwealth  of  Massachusetts,  that  section  shall  be  considered  null  and  void  in  the 
applicable  political  entity.  The  remainder  of  the  contract  shall  remain  in  full  force  and  effect.  If  a  section  of 
the  Selected  Bidders  Contract  is  voided,  the  IW  PMT  and  the  Contractor  shall  negotiate  replacement 
Contract  language  to  make  the  Selected  Bidders  Contract  compliant.  If  the  parties  fail  to  negotiate 
replacement  language,  the  Commonwealth  may  exercise  its  rights  under  Termination  for  Convenience, 
Commonwealth  of  Massachusetts  Terms  and  Conditions. 


Commonwealth  of  Massachusetts 
One  Ashburton  Place,  Room  801 


Information  Technology  Division 
Boston,  Massachusetts  02108 


IW  RFR 

OSD  FILE  #  ITS04 


PAGE  14 
JUNE  10, 1998 


PART  2  -  IW  PROCUREMENT  -  SCOPE  &  SPECIFICATIONS  . 

2.0       PROCUREMENT  SCOPE 

The  Information  Technology  Division  (ITD)  has  been  assigned  the  responsibility  of  overseeing  the 
Commonwealth's  effort  to  coordinate  and  manage  the  implementation  of  the  century  date  change  on 
systems,  both  PC  based  and  mainframe,  networks,  and  agency  infrastructures.  As  part  of  this  process 
ITD  is  seeking  multiple  contractors  to  conduct  Independent  Verification  &  Validation  (IW)  services,  for 
Massachusetts  state  agencies  to  ensure  their  Year  2000  compliance  is  completed  in  a  satisfactory  and 
timely  manner. 

The  verification  and  validation  process  is  expected  to  evaluate  the  various  systems  or  products  to  ensure 
that  they  meet  all  the  ITD  Year  2000  compliance  requirements.  Every  level  of  the  evolving  system,  from 
the  lowest  level  component  up  to  the  total  assembled  system  is  verified  against  previously  defined 
requirements. 

•  The  IW  contractor  will  conduct  an  independent  verification  and  validation  of  project  plans,  work 
-products,  and  deliverables  for  the  contracted  agency 

•  .  The  IW  contractor  will  perform  the  tasks  necessary  to  ensure  that  project  plans,  work  products 

and  deliverable  are  of  the  highest  quality  consistent  with  the  project  requirements,  and  goals 

•  Ensure  that  project  risks  and  anomalies  in  project  plans,  work  products  and  deliverable  are 
identified  as  early  as  possible  to  allow  for  effective  and  timely  resolution 

•  Ensure  that  steps  for  correcting  anomalies  and  mitigating  risks  are  identified,  documented,  and 
communicated  in  a  timely  manner  so  as  to  reduce  the  negative  impact  of  such  anomalies  and 
risks  on  the  success  of  the  overall  project  i> 

The  IW  Bidders  RFR  response  must  describe  the  IW  bidders  strategy/approach,  methodology,  and 
tools,  to  include  a  task  list  necessary  to  perform  the  IW  services  and  products,  and  a  final  report.  Use  of 
non-proprietary  methodology  and  tools  is  preferred. 

fir  '^0^ 

The  IW  Bidder  may  identify  additional  IW  services  and  deliverables  or  modify  the  IW  services  and 
deliverables  so  long  as  the  bidders  proposed  deliverables  are  consistent  with  the  goals  for  IW  PMT.  Any 
alternative  service  must  be  explained  in  detail  in  the  bidder's  offer,  with  specific  justification  for  each 
alternative. 


2.1       GENERAL  BUSINESS  SPECIFICATIONS 

The  following  RFR  sections  highlight  the  critical  minimum  requirements  for  all  Bidders  on  this  RFR.  The 
Bidder  is  required  to  respond  in  the  "affirmative"  that  the  company  accepts  the  RFR  sections  noted  below. 

•  The  Bidder  must  submit  a  written  certification  statement  that  its  gross  annual  income  from  all 
sources  exceeds  $1  Million.  The  Bidder's  Chief  Financial  Officer  or  Accounting  Firm  can  attest  to 
the  facts  in  a  certification  statement  on  the  appropriate  letterhead.  If  necessary,  the  IW  PMT 
reserves  the  right  to  request  additional  information. 

•  The  Bidder  is  required  to  identify  its  current  employment  and  customer  base.  The  Bidder  is 
required  to  respond  to  the  following  items: 

■  Identify  the  current  employment  base  by  number  of  Full  Time  Equivalent  (FTE)  employees. 
The  Bidder's  Chief  Financial  Officer  or  Accounting  Firm  can  attest  to  the  facts  in  a  certification 
statement  on  the  appropriate  letterhead. 

■  Identify  the.-  scope  of  the  customer  base  within  all  eligible  government  entities  in  the 
Commonwealth  (names,  contract  number) 
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The  Bidder  must  state  whether  or  not  it  or  any  subcontractor  has  filed  for  bankruptcy  protection 
within  the  previous  two  (2)  years  If  it  has,  the  vendor  must  explain  the  circumstances. 

The  Bidder  must,  at  a  minimum,  have  three  years  experience  in  Independent  Verification  and 
Validation  business  services  to  government  or  private  industry. 

The  Bidder  must  complete  and  sign  the  Mandatory  Firm  Offer  (Attachment  C)  of  this  RFR.  By 
signing  Attachment  C,  the  Bidder  certifies  that  this  firm  offer  meets  all  of  the  required 
specifications,  requirements  and  procedures  in  this  RFR. 

The  Bidder  must  function  as  the  single  point  of  contact  for  the  IW  PMT,  Commonwealth 
department  and  the  Information  Technology  Division,  regardless  of  use  of  a  subcontractor(s). 

The  Bidder  represents  him/her  to  be  an  independent  contractor  offering  such  services  to  the 
general  public  and  shall  not  represent  him/her/  or  his/her  employees  to  be  employees  of  the 
Commonwealth  of  Massachusetts  orthe  Information  Technology  Division. 

Clarification  of  Responses  -  The  IW  PMT  may  require  the  clarification  of  any  mandatory  and 
desirable  Bidder  RFR  Response.  The  clarification  could  take  the  form  of  written  correspondence 
and/or  interviews  by  the  PTL  and/or  the  IW  PMT  in  order  to  discuss  or  clarify  the  Bidder's 
Response.  Further,  the  PMT  retains  the  right  to  visit  any  and  all  locations  of  a  Bidder  in  order  to 
evaluate  the  Bidder's  RFR  Response.  . 

Addenda  to  RFR  -  If  it  becomes  necessary  to  revise  any  part|of  this  RFR  or  if  additional  data  is 
necessary  to  clarify  any  of  its  provisions,  a  supplement  Willie  posted  on  Comm-PASS.  The 
Commonwealth  reserves  the  right  to  amend,  alter  of%hangei|b  RFR  at  any  time  prior  to  the 
Award.  (Reference  RFR  section  1.1.13)  <f# 

-  ----- 

IW  Services  Pricing  -  The  Bidder,  after  signing  the'Contract,  must  adhere  to  all  pricing  included 
in  the  Contract  unless  otherwise  indicated  in  this7  RFR  or  negotiated  by  the  Procurement  Team 
Leader  and  the  I W  PMT. 


Fixed-Rate  Quotes  for  IW  Services  -  The  Bidder  must  adhere  to  and  guarantee  all  prices  quoted 
to  departments  unless  both  the  department  and  contractor  agree  in  writing  to  a  change  in  the 
scope  of  services. 

Hourly  Rates  Ranges  -  Bidders  are  required  to  include  in  Attachment  B  -  Pricing  Tables,  hourly 
rate  ranges  the  department  or  agency  will  pay  for  Year  2000  IW  services.  The  hourly  rate  ranges 
will  be  fixed  for  the  initial  term  of  the  contract  (Reference  RFR  section  1.4.1).  The  hourly  rate 
ranges  may  increase  up  to  3%  in  the  extension  year,  starting  July  1,2000. 

Periodic  Hourly  Rates  Range  Verification  -  The  Bidder  will  be  required  to  present,  at  least  on  an 
annual  basis,  verification  reports  that  certify  that  the  Contract  is  compliant  with  its  Hour  Rate 
Ranges. 

Government  Tax  Exemption  -  All  items  covered  under  this  Contract  are  exempt  from  sales  tax. 
Therefore,  requisition  forms  supplied  by  the  Awarded  Bidder  must  not  include  a  sales  tax  entry. 

Shipping  and  Delivery  -  Fee  Exemption  -  All  items  covered  under  this  Contract  are  exempt  from 
shipping  charges.  The  Bidder  must  not  include  shipping  charges  on  any  invoice. 

Procurement  Cancellation  -  The  IW  PMT  retains  the  right  to  cancel  this  Procurement  at  any  time 
before  a  Contract  has  been  executed,  in  which  event  the  Commonwealth  will  reject  any  and  all 
Responses  received  in  response  to  this  RFR. 
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Bidder  Disqualification  -  If  a  Bidder  fails  to  meet  any  consequential  or  material  term,  condition, 
requirement  or  procedure,  its  RFR  Response  may  be  deemed  unresponsive  and  disqualified 
(Reference  RFR  section  1.1.1) 

Bidder  RFR  Submissions  -  The  RFR  Responses  and  information  received  will  become  the 
property  of  the  Commonwealth  of  Massachusetts. 

Default  -  Any  event  that  includes,  but  is  not  limited  to  following  events,  may  activate  the  default  of 
the  Contractor  under  this  contract: 


1.  Any  determination  by  the  PTL  and  the  IW  PMT  that  the  business  relationship 
with  eligible  government  entities  has  deteriorated; 

2.  Any  material  misrepresentations  made  by  Contractor;  or 

3.  Any  failure  by  the  Contractor  to  perform  any  of  its  obligations  under  this  contract, 
including  but  not  limited  to,  the  following: 

■  failure  to  commence  performance  of  this  contract  at  the  time  specified  due  to 
a  reason  or  circumstance  within  the  Contractor's  reasonable  control; 

■  failure  to  perform  this  contract  with  sufficient  personnel,  software  licenses, 
services  or  with  sufficient  material  to  ensure  the  completion  of  this  contract 
within  the  specified  time  due  to  a  reason  or  circumstance  within  the 
Contractor's  reasonable  control; 

■  failure  to  perform  this  contract  in  a  manner  reasonably  satisfactory  to  the  PTL 
and  the  IW  PMT; 

■  failure  to  promptly  comply,  within  reasonable  time,  with  requests  for  IW 
services ; 

■  discontinuance  of  the  services  for  reasons  not  beyond  the  Contractor's 
reasonable  control; 

■  failure  to  negotiate  replacement  contract  language  after  determination  was 
made  that  a  contract  provisjpn  is  void; 

■  failure  to  comply  witlra  material  term  of  this  contract,  including  but  not  limited 
to,  provision  of  insurance  and  nondiscrimination;  or 

■  any  other  acts  specifically  and  expressly  stated  in  this  contract  as  constituting 
a  basis  for  termination  of  this  contract. 


2.2       IW  BUSINESS  SPECIFICATIONS 

•  The  Bidder  must  make  available  periodically,  to  the  contracting  department  and/or  the  Information 
Technology  Division,  all  information  on  IW  services  covered  by  the  contractor(s). 

•  •  The  Bidder  shall  make  available,  in  both  hard  and  electronic  versions,  all  documentation  and 

reports  developed  by  the  contractor.  The  documentation  and  reports  shall  become  the  property  of 
the  Commonwealth  of  Massachusetts  and  retained  by  the  department  and  Information 
Technology  Division. 

•  The  Bidder  shall  agree  that  all  discussions  or  information  gained  shall  be  considered  confidential 
and  that  no  information  gathered  by  the  contractor  shall  be  released  to  the  general  public  without 
prior  written  consent  of  the  department  and  review  by  the  Information  Technology  Division. 

•  The  Bidder  and  their  subcontractor(s)  shall  not  hire  any  Commonwealth  of  Massachusetts 
employee  until  the  employee  has  been  out  of  state  government  for  one  (1)  year.  The  Bidder  must 
refer  any  and  all  questions  regarding  employment  of  Commonwealth  staff  to  the  State  Ethics 
Commission. 


The  Bidder  will  perform  all  IW  specifications  and  services  in  a  manner  acceptable  to  the  IW 
PMT,  contracting  department  and/or  the  Information  Technology  Division.   
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The  Bidder  will  work  with  the  appropriate  information  technology  professionals  in 
participating  department  and  Information  Technology  Division  staff  as  deemed  appropriate. 


each 


Each  department  will  be  responsible  for  providing  all  necessary,  workspace,  office  equipment, 
including  a  desktop  computer  for  the  selected  Bidders  staff. 

Each  department  will  be  responsible  for  providing  the  selected  Bidder  with  access  to  all  program 
files,  libraries,  personal  computer  based  systems,  software  packages,  network  systems,  security 
systems,  and  hardware  as  required  to  complete  the  contracted  IW  services. 

The  Bidder  must  obtain  approval  from  the  department  before  installing  or  utilizing  any  automated 
tools  or  software  packages. 

The  Bidder  must  participate  in  an  introductory  meeting  with  the  information  technology 
professionals  from  each  department  where  the  Bidder  has  secured  a  contract. 

The  Bidder  must  participate  in  exit  meeting  with  the  information  technology  professionals  from 
each  department  where  the  Bidder  has  secured  a  contract 

The  Bidder  must  be  able  to  provide  qualified  individuals  to  fill  the  technical  positions  identified  in 
RFR  section  2.4  IW  Personnel  Specifications  and  in  Attachment  B  -  Cost  Tables. 

The  Bidder  is  requested,  in  narrative  form,  to  demonstrate  thejrjcapability  by  providing  evidence 
of  two  (2)  specific  IW  service  projects  within  the  last  two  (£)_ye^rs. 


■  The  Bidder  is  requested  to  provide  a  detailed  description  of  the  I W  service(s)  performed  by 
each  individual,  the  length  of  time  spent  on  each  project  including  the  start  and  end  dates  of 
each  project, -the  specific  systems  enyrrohtrient;  arid  the  number  of  individuals  who  worked  on 
each  project.  t#  v 

■  The  Bidder  is  requested  to  proyidea  statement  summarizing  the  status  of  the  project  and  if 
the  project  was  completed  txrthe  clients  satisfaction. 

The  Bidder  is  requested  to  provide  references  for  each  IW  project  described  in  the  preceding 
paragraphs.  The  references  provided  by  the  Bidder  must  include  the  name  of  the  company, 
address,  contact  person,  telephone  number,  months  and  years  of  service.  The  IW  PMT  will 
utilize  the  references  to  determine  if  the  Bidder  has  the  ability  to  provided  the  I W  services 
requested  in  this  RFR. 

The  Bidder  may  not  reference  any  project(s)  that  were  contracted  by  any  member  of  the  I W 
PMT  (reference  1.6.2). 


2.3       IW  TECHNICAL  SPECIFICATIONS 

The  Bidder  must  describe  the  IW  strategy,  approach,  methodology  and  tools,  include  a  tasks  list 
necessary  to  perform  IW  activities  and  produce  the  deliverables  outlined  below.  The  IW  PMT 
suggests  that  Bidders  utilize  non-proprietary  methodologies  and  tools  where  ever  appropriate.. 

The  Bidder's  proposal  to  every  department  must  include  a  preliminary  schedule  to  accomplish  the 
IW  activities  and  tasks  to  produce  the  minimum  IW  deliverables  required  for  each  IW 
engagement. 

The  Bidder's  proposal  may  identify  additional  IW  deliverables  and  value-added  services  and 
features,  based  on  the  Bidder's  experience  with  other  IW  proposals,  project  requirements  or 
competitive  environment  The  additional  deliverables  must  be  specified  at  the  time  of  Bidder(s) 
proposal  to  a  contracting  department.    This  proposal,  including  additional  cost  if  any,  must  be 
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approved  by  the  contracting  department  prior  to  inception  of  work. 

Minimum  Bidder  IW  Deliverables  -  The  following  deliverables  have  been  identified  by  the  IW 
PMT  as  the  minimum  Bidder  deliverables  that  are  expected  to  be  produced  and  are  due  on  the 
dates(s)  agreed  to  between  the  contractor(s)  and  the  departments.  .  An  outline  of  each  deliverable 
and  criteria  for  acceptability  will  be  developed  and  agreed  upon  prior  to  development  of  the 
document.  The  outline  and  criteria,  with  any  mutually  agreed  upon  changes,  will  be  used  to 
determine  that  acceptability  of  each  deliverable. 


IW  Activities 

Deliverables  L 

I W  Assessment  Plan 

IW  Assessment  Plan,  including: 

♦  Purpose 

♦  Scope  of  Work 

♦  Referenced  Documents 

♦  Definitions 

♦  IW  Overview 

♦  Project  Methodology  and  Tools 

IW  Project  Communication 
Plan 

Monthly  Status  Reports,  including: 

♦  Summary  of  Current  IW  activities 

♦  Planned  1 W  activities  for  the  next  month 

♦  New  Issues  and  Risks 

♦  Status  of  Open  Issues  and  Risks 

IW  Risk  Management  Areas 

IW  Risk  Assessment,  to. include: 

♦  Risk  Assessment  Method 

♦  Documentation  of  ldentified.iRisks 

♦  Recommended  Risk  Mitigation  Strategy 
♦ 

IW  Department  Summary 

1 W  Final  Report,  including: 

♦  Summary  of  all  IW  Activities 

♦  Summary  of  Task  Results 

♦  Summary  of  Anomalies  and  Resolutions 

♦  Lessons  Learned/Best  Practices 

♦  Recommendations 

2.4       IW  PERSONNEL  SPECIFICATIONS 

•  The  contractor  must  provide  qualified  personnel  with  experience  in  year  2000  consulting  to 
conduct  a  verification  and  validation  of  Year  2000  processes.  The  IW  vendor's  proposed  project 
team  must  meet  the  following  minimum  qualifications: 

■  IW  Project  Manager  must  have  a  minimum  of  five  (5)  years  of  experience  with  a  combination 
of  two  or  more  of  the  following:  Business  Process  Reengineering;  Information  Systems 
development;  IW;  Quality  Assurance;  requirements;  definition;  and  analysis;  Configuration 
Management;  and  Systems  Engineering.  The  IW  Project  Manager  must  have  a  least  three 
(3)  years  of  experience  in  IW,  preferably  in  a  similar  role. 

■  IW  Team  Members  (excluding  administrative  support  staff,  if  included  in  the  offer)  must  have 
a  minimum  of  three  (3)  years  of  experience  with  a  combination  of  two  or  more  of  the  following: 
Business  Process  Reengineering;  Information  Systems  development;  IW;  Quality  Assurance; 
requirements;  definition  and  analysis;  Configuration  Management;  and  Systems  Engineering. 

■  IW  Team  members  must  have  at  least  one  (1 )  years  of  experience  in  IW.  
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■  IW  Project  Manager  and  Team  Members  must  have  experience  with  large  information 
technology  projects  in  a  similar  function/technical  role.  In  addition,  the  Bidder's  proposed 
Project  Manager  and  Team  Members  must  have  experience  with  the  IW  methodology  and 
tools  described  in  the  vendor's  offer. 

•  The  Bidder  must  provide  a  statement  certifying  that  they  can  provide  the  IW  personnel  proposed 
in  their  responses  to  the  personnel  specifications  over  the  term  of  the  contract  and  how  the  Bidder 
will  meet  this  commitment. 

•  The  Bidder  must  agree  in  its  RFR  response  that  if  the  company  requests  to  replace  approved 
personnel  on  a  contracting  engagement,  the  Bidder  will  propose  a  replacement  with  equivalent  or 
better  experience  at  no  additional  cost  to  the  department. 

•  The  Bidder  must  agree  in  its  proposal  that  if  the  IW  PMT,  department  or  Information  Technology 
Division  is  not  satisfied  with  the  performance  of  any  of  the  approved  personnel,  the  department 
will  have  the  right  to  require  the  vendor  to  remove  and  replace  such  personnel. 

•  The  IW  PMT  may  require  the  Contractor  to  relieve  and  replace  the  Project  Manager  if  in  the  IW 
PMT,  department  or  Information  Technology  Division's  opinion  it  appears  that: 

■  The  Project  Manager  does  not  perform  at  the  applicable  skill  level  specified  in  the  Contract; 

■  The  Project  Manager  does  not  deliver  work  which  conforms  to  the  performance  standards 
stated  in  the  Contract;  and/or 

■  Personality  conflicts  with  the  Project  Manager  hinder^ffectlve  functioning  of  the  Contract. 

•  The  Commonwealth  of  Massachusetts  reserves  the  right  to  approve  or  reject  any  of  the 
contractor's  proposed  personnel. 

•  The  Bidder  must  agree  that  no  substijtjjtion  of  specified  personnel  identified  in  the  contractor's 
proposal  shall  be  made  without  written  ilproval  of  the  department 


PART  3  -  IW  PRICING  SPECIFICATIONS 

3.0       IW  PRICING  SPECIFICATIONS  (See  Attachment  B  -  Pricing  Worksheet) 

•  The  Bidder  must  respond  using  the  pricing  format  outlined  in  Exhibits  1,2  &  3. 

•  The  Bidder  must  include  the  price  for  IW  activities,  task(s)  and  preparation  of  required 
deliverables  based  on  the  proposed  approach,  methodology,  and  tools. 

•  The  Bidder  must  complete  and  submit  with  the  RFR  response  the  IW  pricing  specification  matrix 
(Exhibit  1)  in  Attachment  B.  The  Bidder  must  enter  a  range  of  costs  by  entering  a  rate  in  the  low 
rate  box  and  the  high  rate  box  for  each  personnel  specification.  The  Bidder's  price  must  include 
all  standard  business  expenses  (per  diem,  G  &  A,  travel)  that  the  Bidder  incurs  in  connection  with 
the  IW  services. 


Exhibit  1:  IW  Project  Team 

^^^HpurlyjBsii^^ 

IW  Project  Manager 

$0.00 

$0.00 

IW  Team  Member 

$0.00 

$0.00 

IW  Administrative  Support 

$0.00 

$0.00 

Commonwealth  of  Massachusetts 
One  Ashburton  Place,  Room  801 


Information  Technology  Division 
Boston,  Massachusetts  02108 


IW  RFR 

OSD  FILE  #  ITS04 


PAGE  20 
JUNE  10, 1998 


•  The  Bidder  after  contract  award,  subject  to  the  approval  of  the  IW  PMT,  may  submit  special 
requests  to  add  personnel  classifications.  The  Bidder  must  include  a  low  rate  and  high  rate  along 
with  a  position  description,  a  proposed  candidate's  resume  and  the  IW  task(s)  on  which  the 
proposed  IW  service  personnel  will  be  utilized. 

•  The  Bidder  must  list  the  position  title,  number  of  personnel,  number  of  hours,  and  price  per  hour 
for  each  project  team  member  included  in  the  Bidders  offer. 


Important  Note: 

The  PMT  has  included  Exhibits  2  and  3  as  a  suggested  uniform  project  methodology  for  both  the 
contracting  department  and  the  IW  services  contractor.  The  PMT  pricing  worksheet  may  be  modified 
to  meet  the  specific  IW  services  requirements  of  the  contracting  department. 


Exhibit  2:  IW  Project  Team 


..JW.PositiG 

fvMceiPer  , 

Extended  . 

florin 
«FTE) 

el 

m  i 

Hour 

4 

Price  , 

Project  Manager 

0.0 

$0.00 

$0.00 

Team  Member  #1 

0.0 

$0.00 

$0.00 

Team  Member  #2 

0.0 

$0.00 

$0.00 

Team  Member  #3 

0.0 

$0.00 

$0.00 

Administrative  Support 
Staff 

0.0 

$0.00 

$0.00 

Total 

0.0 

$0.00 

$0.00 

Exhibit  3:  IW  Activities  and  Deliverables 

IW  Deliverables  f 

^Deliverables 

;Hours^- 

Extended 
Price 

IW  Assessment 

0.0 

$0.00 

IW  Project  Communication  Plan 

0.0 

$0.00 

I W  Risk  Management  Areas 

0.0 

$0.00 

IW  Department  Summary 

0.0 

$0.00 

Additional  Services/Features 

0.0 

$0.00 

Additional  Services/Features 

0.0 

$0.00 

Total 

0.0 

$0.00 

•  Valued-Added  Services  and  Features  -  The  Bidder  may  offer  additional  discounts  and/or  value- 
added  services  and  features.  The  Bidder  is  requested  to  identify  the  cost  methodology  for  the 
products,  and/or  services  they  are  proposing  in  the  RFR  Response. 

•  When  the  selected  Bidder  provides  a  quote  to  the  contracting  department  based  on  the  scope  of 
services  and  deliverables,  it  must  include  hours  and  extended  prices.  The  quoted  rates  for  each 
contracting  department  are  fixed  for  the  term  of  the  engagement,  unless  otherwise  amended. 
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PART  4  -  PERFORMANCE  AND  REPORTING  REQUIREMENTS 


4.0       CONTRACTOR  PERFORMANCE  AND  REPORTING  REQUIREMENTS 

The  IW  PMT  is  proposing  to  deliver  a  best  value  contract  with  multiple  Bidder(s)  that  will  facilitate  the  IW 
needs  of  departments  in  the  Commonwealth.  Furthermore,  the  IW  PMT  through  this  contract  will 
establish  a  partnership  with  the  Bidder,  and  the  IW  PMT  and  the  Bidder  hereby  agree  to  establish 
performance  and  reporting  requirements  to  safeguard  and  ensure  contract  performance.  The  selected 
Bidder(s)  should  be  aware  that  the  IW  PMT  may  alter  performance  and  reporting  requirements  during  the 
term  of  this  Contract  to  meet  the  needs  of  the  Commonwealth. 


4.1  IW  PMT  -  STATE  FISCAL  YEAR  ANNUAL  AND  QUARTERLY  REPORT  SUBMISSION 
The  Bidder  must  deliver  Annual  and  Quarterly  reports  to  the  IW  PMT  within  fifteen  (15)  calendar  days 
after  the  close  of  a  State  Fiscal  Year  Quarter.  The  annual  and  quarterly  reports  will  include  all  prior  and 
current  IW  service*  oerformed  with  the  Commonwealth  under  this  contract.  If  a  submission  deadline  falls 
on  either  a  Federal  and  State  Holiday  or  non-business  day  (Saturday/Sunday)  the  report  will  be  due  on 
then      .usptss  day. 


ua      Ending  Submission  Deadline  Report  Due 

September  3CT  October  15th  Quarterly 

December  31st  January  15th  Quarterly 

March  31st  April  15m  Quarterly 

June  30th  July  15th  Annual  &  Quarterly 

4.2       REPORT  FORMATS 

•  Paper  Submission  -  The  Bidder  must  submit  one  (1)  original  annual  or  quarterly  report  and  two 
(2)  copies  on  8  Yz"  x  11"  paper  in  three  (3)  ring  binders.  Both  the  original  and  copies  must  be 
submitted  on  recycled  paper. 

•  Electronic  Submission  -  The  Bidder  must  submit  reports  on  3.5"  diskette.  The  Bidder  must  use 
Microsoft®  Word  for  Windows95,  Version  7.0  or  lower,  Microsoft®  Excel  for  Windows95,  Version 
7.0  or  lower,  and  ,  Microsoft®  Access  for  Windows95,  Version  7.0  or  lower.  The  Bidder  must 
label  all  disks  including  the  following  information:  Contractor,  address,  contact  name,  telephone 
number  and  Contract  Number  ITS04. 
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MASSACHUSETTS  Y2K  COMPLIANCE  ACTIVITIES 
INITIATIVES  AND  ACTIONS 


INTRODUCTION 

In  early  1996,  the  Commonwealth  of  Massachusetts  Information  Technology  Division 
(ITD)  began  a  Year  2000  (Y2K)  awareness  program  with  the  distribution  of  an  ITD  Year 
2000  white  paper  to  state  agencies  and  entities.  Various  members  of  ITD's  Strategic 
Planning  Group  (SPG)  engaged  in  a  number  of  other  awareness  activities  and,  in  June 
1997,  SPG  created  a  Year  2000  Program  Management  Office  (Y2K  PMO)  to  coordinate 
the  Commonwealth's  Year  2000  effort. 

Charles  D.  Baker,  Secretary  of  Administration  and  Finance,  directed  all  Secretaries  and 
Department  heads  in  September,  1998,  to  treat  Year  2000  compliance  activities  as  their 
top  operational  planning  priority. 

Governor  Argeo  Paul  Cellucci  issued  an  Executive  Order  in  December,  1998,  making 
year  2000  activities  the  chief  operational  priority  for  state  agencies,  and  specifically 
assigned  these  responsibilities  to  the  head  of  each  agency. 

PMO  ACTIVITIES 

The  Y2K  PMO  team  consists  of  six  full  time  staff,  including  a  Y2K  PMO  Project 
Manager,  and  the  Director  of  the  Strategic  Planning  Group  who  is  also  the  Y2K  Program 
Manager.  The  purpose  of  the  Y2K  PMO  is  to  help  the  CIO  meet  the  goal  of 
"uninterrupted  turn-of-century  service  delivery".  To  support  this  effort  the  PMO  is 
engaged  in  a  number  of  activities  to: 

•  Monitor  statewide  Year  2000  efforts  and  agency  progress  in  meeting  the  Year 
2000  challenge; 

•  Provide  coordination  and  support  to  agency  Y2K  projects  as  required  to  promote 
risk  mitigation  activities;  and 

•  Foster  awareness  and  exchange  of  technical  information. 

MONITOR  STATEWIDE  YEAR  2000  EFFORTS  AND  PROGRESS 

In  July  1997,  the  Y2K  PMO  staff  embarked  on  an  effort  to  visit  Commonwealth  agencies 
to  ascertain  the  status  of  Year  2000  projects  and  to  identify  the  Commonwealth's 
mission-critical  and  essential  systems.  This  first  round  of  interviews  established  a 
baseline  for  measuring  future  progress,  and  identified  risk  areas. 

As  of  July  1998,  the  PMO  team  has  conducted  three  more  rounds  of  interviews  and 
initiated  a  fifth  round  to  obtain  update  information  on  a  quarterly  basis.  During  the  last 
quarter,  the  PMO  team  revisited  all  agencies  to  obtain  a  complete  Y2K  project  update  for 
the  Commonwealth. 
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In  order  to  facilitate  data  collection  and  monitor  progress,  the  Y2K  PMO  has  developed 
and  maintains  a  database  to  track,  by  agency,  Year  2000  assessment,  planning,  validation 
and  deployment  activities  as  well  as  the  compliance  status  of  Commonwealth  mission- 
critical  and  essential  systems.  In  addition,  the  PMO  has  developed  a  process  for 
determining  risk  levels  for  systems  and  agencies,  which  reflect  the  status  of  information 
collected  for  a  given  quarter.  Risk  levels  are  coded  as  red  for  high  schedule  risk;  yellow 
for  medium;  and  green  for  low. 

Currently,  83%  of  the  nearly  450  systems  being  tracked  are  scheduled  to  meet  the 
Commonwealth's  remediate-and-return-to-production  goal  of  January  31,  1999  for 
mission  critical  and  May  31,  1999  for  essential  systems.  Sixteen  percent  are  still  being 
analyzed  and  yet  to  be  scheduled.  One  percent  have  scheduled  completion  dates 
extending  into  the  July  -  November  1999  timeframe. 

PROVIDE  COORDINATION  AND  SUPPORT 

The  Y2K  PMO  provides  coordination  and  support  to  the  agencies  of  the  Commonwealth 
in  a  number  of  ways: 

•  Project  Assistance 

Staff  members  in  the  Y2K  PMO  provide  technical  assistance  in  selecting  tools  for 
Year  2000  fixes.  In  addition,  the  PMO  staff  also  provides  planning  assistance,  as 
needed,  in  preparing  or  reviewing  agency  assessments  and  plans  for  addressing 
the  Year  2000  challenge.  For  several  executive  level  departments  with  a  high 
percentage  of  mission  critical  agencies  or  Commonwealth  mission  critical 
systems,  the  PMO  has  assigned  a  team  member  as  a  liaison.  The  liaison  attends 
department  wide  MIS  meetings,  Y2K  meetings,  and  is  in  frequent  touch  with  the 
appropriate  agency  and  system  managers.  The  liaison  also  helps  the  department 
and/or  agencies  to  find  solutions  to  Y2K  resource  and  schedule  problems. 

•  Year  2000  Materials 

The  Y2K  PMO  has  produced  a  variety  of  materials  that  can  be  used  by  agencies 
in  their  Y2K  projects.  These  include: 

•  Year  2000,  date  standards,  as  well  as  other  standards  like  the 
Commonwealth  Y2K  Standards  and  Guidelines  for  Information 
Technology  which  address  hardware  and  software; 

•  Information  originally  published  by  the  state's  procurement  office  which 
includes  sample  Year  2000  language  for  use  in  Requests  for  Proposals, 
guidance  for  contracts  relating  to  interfaced,  large,  and/or  critical  systems, 
and  a  list  of  approved  vendors  who  have  signed  a  Year  2000  warranty 
agreement  with  the  Commonwealth; 

•  A  list  of  the  most  frequently  used  commercial  off-the-shelf  software 
(COTS)  and  compliance  information  for  these  products; 

•  A  standard  letter  that  agencies  can  send  to  vendors  of  COTS  not 
commonly  used  and  sample  spreadsheets  for  tracking  the  compliance  and 
replacement  strategy  of  each  product; 

•  A  standard  letter  to  landlords  requesting  facility  information  from 
landlords  of  agencies  renting  space  in  non-state  owned  buildings; 
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•  An  Interface  Management  document  which  will  provide  agencies  with 
tables  they  can  use  to  inventory  and  track  every  interface  for  all  their 
systems; 

•  Agency  Year  2000  Test  Support  Manual  for  agencies  which  develop  and 
maintain  systems  that  run  on  the  ITD  mainframe  computer, 

•  A  compliance  statement  for  agencies  to  perform  a  self-assessment  of  their 
status;  and 

•  A  funding  request  process  designed  to  help  agencies  needing  additional 
monies  for  Y2K  remediation  to  submit  all  the  required  information  to 
support  their  request. 

•  Workshops 

The  Y2K  PMO  has  developed  two  workshops  to  assist  agencies  with  specific 
Y2K  tasks: 

•  In  September  1997,  the  PMO  organized  a  workshop  which  focussed  on 
Year  2000  project  management  and  assessment  issues  necessary  for  an 
effective  Year  2000  project  launch.  The  PMO  included  in  the  workshop  a 
Sample  Project  Plan  for  the  attendees  to  use  to  organize  their  projects. 

•  In  order  to  avoid  agencies'  'reinventing  the  wheel',  the  PMO  developed  a 
workshop  for  testing  PC's. Two  workshops  are  offered,  the  first  of  which 
dealt  with  BIOS  problems.  A  2-hour  workshop  was  offered  10  times  over 
a  4  week  period  dealing  with  hardware  issues.  Recently,  sessions  were 
held  that  were  directed  at  the  software  compliance  issues  PC  owners  are 
facing.  Agencies  sent  as  many  of  their  technical  staff  as  they  chose  and 
were  encouraged  specifically  to  send  the  staff  members  who  will  be 
testing  their  PC's.  The  PMO  provided  each  attendee  with  a  starter  kit. 

FOSTER  AWARENESS  AND  EXCHANGE  OF  TECHNICAL  INFORMATION 

The  Y2K  PMO  sponsors  monthly  meetings  of  the  Massachusetts  Government  Year  2000 
User  Group.  The  User  Group  meetings,  open  to  all  agency  and  department  staff,  were 
established  as  a  forum  for  agencies  to  share  information  and  lessons  learned  regarding 
Year  2000  remediation  and  a  place  to  get  help  with  any  problems  they  may  be  having. 
The  Y2K  PMO  also  hosts  quarterly  Year  2000  Days  and  vendor  days  which  provide  an 
additional  means  of  disseminating  current  information  on  Year  2000  issues.  Speakers  at 
these  events  have  included  Microsoft,  Oracle,  Lucent  Technology,  Digital  Equipment 
Corporation,  the  Gartner  Group,  and  Banyan  Systems. 

The  Y2K  PMO  maintains  a  Year  2000  Web  site  for  Project  information  and  useful  links. 
The  URL  for  this  site  is  http  ://www. state. ma.us/y2k.  The  web  site  includes  reference 
material  and  other  PMO  documents,  such  as  Vendor  Management  information  and  the 
Standard  Letter  to  Landlords.  It  provides  Business  Continuity  and  Contingency  Planning 
models  (templates),  links  to  other  web  sites  with  helpful  information,  and  frequently 
asked  questions. 
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The  PMO  also  contributes  to  or  publishes  Year  2000  technical  and  reference  information: 


•  Each  issue  of  ITD's  quarterly  Information  Technology  Bulletin  contains  material 
written  by  the  PMO,  about  the  Year  2000,  starting  with  the  Winter  1997  issue. 
The  IT  Bulletin  is  also  available  on  the  Web  at 
http://www.state.ma.us/itd/bulletin/. 

•  In  April  1 997,  ITD  published  the  first  edition  of  Year  2000,  Meeting  the 
Challenge,  a  reference  book  for  the  agencies.  Requests  for  over  1500  copies  of 
the  book  were  received  by  ITD.  In  October  1997,  the  PMO  published  a  second 
edition  of  Year  2000,  Meeting  the  Challenge.  It  focused  on  the  activities  agencies 
should  be  involved  in  today  if  they  are  to  meet  the  Year  2000  challenge  and 
provided  updated  reference  lists.  The  PMO  is  currently  working  on  a  third  edition 
which  will  feature  discussions  on  testing,  risk  management,  and  embedded 
systems  in  addition  to  providing  updated  reference  lists. 

•  The  Y2K  PMO  produced  a  white  paper  entitled,  "PC  BIOS  and  the  Year  2000" 
which  describes  in  simple  terms  what  the  PC  BIOS  'problem'  is,  methods  to  test 
for  it,  ways  to  correct  it,  and  the  impact  of  not  correcting  it.  The  white  paper  was 
distributed  to  agency  Y2K  coordinators  and  is  also  available  on  the  PMO's  Y2K 
web  site. 

•  A  white  paper  addressing  Y2K  issues  specific  to  cities  and  towns  was  published 
in  October,  1998.  In  addition,  articles  are  published  monthly  in  "The  Beacon",  a 
Massachusetts  Municipal  Association  publication  distributed  throughout  the 
Commonwealth. 

•  The  PMO  also  participates  in  a  monthly  interstate  conference  call  which  includes 
John  Koshinen,  the  Federal  government  Y2K  coordinator  for  the  President. 

•  Monthly  meetings  are  attended  with  Federal  Agencies  and  other  State  Y2k 
coordinators  to  review  progress,  share  information  and  coordinate  activities. 

Outreach  to  local  and  municipal  governments  and  organizations  has  become  a  priority  for 
the  PMO.  The  Y2K  PMO  Program  Manager  has  addressed  several  organizations 
including  the  Massachusetts  Municipal  Association  and  the  Association  of  Government 
Accountants.  Other  members  of  the  PMO  participated  in  several  quarterly  Boston 
Millenium  Association  Meetings.  The  PMO  is  also  encouraging  agencies  to  conduct  their 
own  outreach  programs  to  their  constituents.  For  example,  the  Division  of  Banks  and  the 
Division  of  Insurance,  agencies  within  the  Office  of  Consumer  Affairs,  have  been 
working  with  local  banks/insurance  companies  to  ensure  that  they  will  be  ready  for  the 
Year  2000.  Whenever  possible,  the  PMO  works  with  agencies  that  have  alliances  with 
local  and  municipal  organizations  to  encourage  and  support  these  outreach  efforts.  For 
instance: 

•  The  Department  of  Education  is  reaching  out  to  the  public  schools  in  the 
Commonwealth.  They  have  identified  all  the  administrative  software  packages  in 
use  by  all  of  the  school  districts  across  the  state.  The  major  vendors  have  been 
contacted  regarding  Y2K  compliance  of  their  products  and  DOE  will  disseminate 
the  information  to  the  school  districts.  DOE  has  also  identified  the  most 
frequently  used  desktop  software  in  the  public  school  districts  and  is  publishing 
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the  compliance  status  of  those  products  on  its  web  site.  DOE  has  identified  a  need 
to  improve  awareness  in  the  school  districts  across  the  state  and  they  are 
committed  to  devoting  more  resources  to  familiarize  schools  with  the  potential 
dangers  of  non-compliance. 

•  The  Division  of  Banks  within  the  Office  of  Consumer  Affairs  began  an  education 
campaign  with  the  Commonwealth  financial  institutions  in  early  1997.  Their 
annual  examinations  of  these  institutions  include  Y2K  compliance  questions.  In 
addition,  DOB  has  spoken  on  the  Y2K  issue  at  over  15  industry  sponsored 
banking  seminars.  On  a  quarterly  basis,  the  FDIC,  in  cooperation  with  DOB, 
examines  banks  and  credit  unions  solely  on  Y2K  compliance  status.  Any  financial 
institutions  experiencing  problems  with  their  Y2K  efforts  are  examined  more 
frequently.  Recently,  the  DOB  also  surveyed  non-bank  licensees  and  has  begun 
examining  them  on  Y2K  status  on  a  regular  basis. 

•  The  Division  of  Insurance,  also  within  the  Office  of  Consumer  Affairs,  began  an 
awareness  campaign  across  Commonwealth-based  insurers  in  mid- 1997  with  a 
survey.  Based  on  the  results  of  the  survey,  the  DOI  procured  an  independent 
consultant  to  audit  each  Massachusetts  domestic  insurer  for  Y2K  compliance.  The 
DOI  expects  to  complete  the  audit  by  the  end  of  this  calendar  year.  Further 
actions  may  be  taken  based  on  the  results  of  the  audit. 

•  The  Department  of  Revenue  began  an  awareness  campaign  two  years  ago 
through  speaking  engagements  at  various  meetings  and  conferences  of  local 
officials,  such  as  the  Massachusetts  Municipal  Association,  Collector/Treasurer, 
Finance  Committees,  Accountants/ Auditors,  Management  Information  Directors, 
and  Assessors.  DOR  also  conducted  telephone  surveys  of  all  351  cities  and  towns 
on  Y2K  readiness.  In  addition,  DOR  publishes  articles  and  reminders  in  every 
issue  of  City  &  Town  and  maintains  a  web  page  devoted  to  local  government 
Y2K  issues.  DOR  has  mandated  that,  in  order  to  have  a  FY99  tax  rate  set, 
communities  must  submit  a  report  from  their  CFO  on  the  Y2K  compliance  status 
of  all  major  municipal  computer  systems. 

•  The  Division  of  Local  Services  (DLS),  a  part  of  the  DOR,  has  initiated  an 
outreach  program  targeted  to  the  smallest  cities  and  towns  in  the  Commonwealth. 
A  pilot  program  .with  17  towns  having  populations  under  5000  citizens  has  begun 
to  determine  the  feasibility  of  providing  more  direct,  on-site  analysis  and  support 
of  towns  lacking  sufficient  staff  to  adequately  perform  year  2000  assessments  for 
non-compliant  systems,  initiation  of  vendor  management  programs,  development 
of  community-specific  risk  management  and  contingency  programs.  DLS  will 
also  recommend  remediation/replacement  strategies  for  at  risk  systems. 

•  Over  the  past  three  years  the  Department  of  Housing  and  Community 
Development  has  been  working  with  the  local  Housing  Authorities  across  the 
state  to  raise  Y2K  awareness  and  monitor  compliance.  DHCD  has  discussed  the 
Y2K  issue  at  working  group  meetings,  at  conferences,  and  with  the  major  housing 
software  vendors  in  the  Commonwealth.  DHCD  has  contacted  individually  all  of 
the  Housing  Authorities  that  they  believe  to  be  at  high  risk.  They  have  also 
requested  all  Housing  Authorities  to  verify  their  plans  for  achieving  Y2K 
compliance  before  the  end  of  CY99. 
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•  The  Massachusetts  Highway  Department  within  the  Office  of  Transportation 
and  Construction  is  especially  concerned  about  traffic  signals  across  the 
Commonwealth.  The  MassHighway  planning  controllers  group  that  meets 
regularly  with  regional  planning  groups  will  be  addressing  Y2K  issues,  especially 
as  it  relates  to  traffic  signals. 

•  In  March  1998,  the  Office  of  the  State  Auditor  mailed  a  packet  of  information  to 
every  city  and  town  in  the  Commonwealth.  The  Y2K  PMO  provided  the 
Auditor's  Office  with  copies  of  their  Y2K  booklet,  Year  2000  Compliance, 
Meeting  the  Challenge,  Second  Edition,  to  include  in  the  packet.  - 

•  Massachusetts  Emergency  Management  Agency  (MEMA),  of  the  Department 
of  Public  Safety,  is  the  agency  responsible  for  planning  for  all  statewide 
emergencies.  As  a  part  of  their  normal  emergency  planning  activities,  the  agency 
has  initiated  communication  and  preparedness  activities.  Among  these  activites 
are  included  educational  activities  for  MEMA  participating  agencies,  outreach 
activities  to  cities  and  towns  normally  included  in  all  MEMA  activities  as  well  as 
participation  with  the  Federal  Emergency  Management  Agency  (FEMA)  on 
regional/New  England  planning. 

SUMMARY 

The  Y2K  PMO's  goal  is  to  ensure  all  Commonwealth  agencies  will  be  able  to  provide 
"uninterrupted  turn-of-century  service  delivery".  They  are  approaching  this  from  many 
angles:  monitoring  agencies  progress,  providing  information  common  to  all  agencies, 
providing  support,  and  disseminating  lessons  learned  information.  The  efforts  of  the 
PMO  are  paying  off  in  terms  of  agency  awareness  and  progress  toward  meeting  our 
goals. 

The  PMO  has  taken  a  conservative  approach  to  planning  for  remediation  activites,  and 
asked  each  agency  to  target  completion  of  their  work  for  January,  1999. 

As  of  the  close  of  the  July  -  September  1998  quarter,  The  PMO  had  collected  information 
on  266  mission  critical  systems  and  191  essential  systems  identified  in  169  agencies,  with 
the  following  results: 

•  Approximately  74%  of  these  systems  were  scheduled  for  completion  by  Jan.  1999. 

•  Approximately  4%  of  these  systems  had  some  risk  of  missing  the  January  date. 

•  Approximately  19%  of  these  systems  were  likely  to  miss  the  January  date. 

•  The  remaining  3%  were  not  evaluated  for  this  quarter. 

All  agencies  are  planning  to  have  completed  remediation  or  business  continuity  plans 
prior  to  the  close  of  calendar  1999. 
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